LEGAL
Subprocessors
Every supplier that can touch data in the course of running Modelvia, what it is for, where it runs and what it receives. We publish changes to this list when the suppliers we use change.
Current subprocessors
| Name | Purpose | Region | Data it receives |
|---|---|---|---|
| Vercel | Hosts the website and the portal. | Sydney, Australia | Requests to the portal, including session cookies. No prompts and no database. |
| Fly.io | Hosts the API gateway. | Sydney, Australia | API requests pass through the gateway in memory. Database backup jobs also write a temporary plaintext database dump to local disk, encrypt it into a staged archive, and attempt to remove the temporary files in cleanup. |
| Neon | Managed PostgreSQL for the ledger and for identity, and object storage for their encrypted backups. | Databases: Sydney, Australia. Encrypted backups: Singapore | Accounts, memberships, key hashes, usage and request records, invoices, payments and the financial event log. No prompts. |
| OpenRouter | Model access and routing: delivers each request to the reviewed host(s) listed for its model: zero-data-retention hosts, except DeepSeek's own endpoint for DeepSeek V4.1 Flash. | United States. The model itself runs wherever the host listed for the route runs | The prompt, the tool definitions when the request carries them, and the output ceiling. Requests for every model except DeepSeek V4.1 Flash are sent with zero data retention required and data collection denied, with the upstream prompt cache disabled; DeepSeek V4.1 Flash requests are sent without zero data retention and with data collection allowed (see the DeepSeek row). Fallback is limited to the reviewed zero-data-retention hosts listed for that model, never to any other host — none for DeepSeek V4.1 Flash (single-pinned to DeepSeek), Amazon Bedrock then Google Vertex AI for Claude Sonnet 5.5. |
| Jev / TypeSafe | The Jev routing classifier: receives request content to choose a model when a request asks for automatic routing. Also the zero-data-retention host serving computer-use decisions (Jev 1.13), reached via OpenRouter. | Determined by that service | The conversation messages, a flag for whether tools are available, and the output ceiling — only for requests that ask for the auto model where more than one route could serve them. Tool definitions and earlier private reasoning are not sent. For computer-use decisions: the state and questions the caller sends to /v1/decisions, which may include screen or page content, forwarded by OpenRouter only to the pinned endpoint typesafe, which OpenRouter lists as zero data retention, with zero data retention required, data collection denied and the upstream cache disabled. The caller's session and user identifiers are not sent. |
| DeepSeek | Host serving the DeepSeek V4.1 Flash model (DeepSeek V4.1 Flash 1017), reached via OpenRouter. Not zero data retention. | Determined by the DeepSeek endpoint pinned to the route; not yet verified | The request OpenRouter forwards for DeepSeek V4.1 Flash: the prompt, tool definitions when present, and the output ceiling. It goes only to DeepSeek's own endpoint (deepseek), which OpenRouter does not list as zero data retention, and it is sent with data collection allowed, so DeepSeek may retain the content and use it under its own terms. Requests on this model are not zero data retention. |
| Amazon Web Services (Bedrock) | Zero-data-retention host serving the Claude Sonnet 5.5 model, reached via OpenRouter. | Determined by the Amazon Web Services (Bedrock) endpoint pinned to the route; not yet verified | The request OpenRouter forwards for Claude Sonnet 5.5: the prompt, tool definitions when present, and the output ceiling, with temperature and top_p omitted before dispatch. It goes only to the reviewed endpoint amazon-bedrock, which OpenRouter lists as zero data retention, with the same zero-data-retention, no-data-collection and cache settings, and with Google (Vertex AI) as a same-price fallback when this host does not serve the request. |
| Google (Vertex AI) | Zero-data-retention host serving the Claude Sonnet 5.5 model, reached via OpenRouter. | Determined by the Google (Vertex AI) endpoint pinned to the route; not yet verified | The same request Amazon Bedrock would otherwise receive for Claude Sonnet 5.5 — the prompt, tool definitions when present, and the output ceiling — sent only when OpenRouter falls back from Amazon Bedrock to this host. It goes only to the reviewed endpoint google-vertex/global, which OpenRouter lists as zero data retention, with the same zero-data-retention, no-data-collection and cache settings. |
| OpenAI | Serves GPT-6 Luna Decisions, one of the two computer-use decisions models, reached via OpenRouter. | Determined by OpenAI's endpoint; not yet verified | The state and questions an app sends to /v1/decisions for this model, which may include screen or page text. It goes only to OpenAI's own endpoint (openai), which OpenRouter does not list as zero data retention, so OpenAI may keep it under its standard API retention (up to 30 days, for abuse monitoring). Data collection for training is denied, and the caller's session and user identifiers are not sent. No chat request is sent to OpenAI. |
| Square | Collects payments from a client's own customers, in sandbox or live mode. | Determined by the client's Square merchant account | Customer name, email, the invoice amount and the line description. Card details go straight to Square and never reach Modelvia. |
| Resend | Delivers account setup and recovery emails and operational alerts. | Primarily United States per Resend's DPA; this account's sending region is unverified | For account mail: recipient email, a one-time setup or recovery link and its expiry, and the message text. For alerts: recipient email and a redacted operational event. No API keys or prompts are sent in these email payloads. |
Model developers are not subprocessors, with two exceptions. OpenAI is listed above because GPT-6 Luna Decisions is served by OpenAI's own endpoint, and DeepSeek is listed because DeepSeek V4.1 Flash is served by DeepSeek's own endpoint. Anthropic develops Claude Sonnet 5.5. It builds the model but does not receive request content: Claude requests are pinned to Amazon Web Services (Bedrock) or Google (Vertex AI), and the endpoint Anthropic runs itself on OpenRouter, which is not zero data retention, is not used.
Correction, 24 September 2026: Resend was already used to deliver account email and operational alerts but was missing from an earlier version of this list. Its addition here records that existing processing; it does not mark a new activation.
Update, 25 September 2026: both models are now served only by zero-data-retention hosts reached through OpenRouter: DeepSeek V4.1 Flash by DeepInfra and Kimi K3 by Parasail. DeepInfra and Parasail are added to this list. DeepSeek and Moonshot AI, which an earlier version of this list named as model providers, are removed from it because they no longer receive request content.
Update, 29 September 2026: Kimi K3 is retired, so Parasail no longer receives request content and is removed from this list. Claude Sonnet 5.5 is added, served only by zero-data-retention hosts reached through OpenRouter: Amazon Web Services (Bedrock) first, with Google (Vertex AI) as a same-price fallback when Bedrock does not serve the request. Both are added to this list for model inference, with the same zero-data-retention, no-training handling as every other model host.
Update, 8 October 2026: OpenAI is added for GPT-6 Luna Decisions, which RealBud's app can use for computer-use decisions. It was the only route that was not zero data retention at the time, and it should have been listed when it began serving earlier the same day. The API gateway moved from Render (Singapore) to Fly.io (Sydney), and both databases moved to Neon in Sydney; Render no longer receives data. Claude routes now use the host's 5-minute prompt cache, keyed to one tenant's conversation.
Update, 17 October 2026: DeepSeek V4.1 Flash now calls the 17 October 2026 snapshot (DeepSeek V4.1 Flash 1017), pinned to DeepSeek's own endpoint through OpenRouter. That endpoint is not zero data retention and the route allows data collection, so DeepSeek may retain request content on this model and use it under its own terms. DeepSeek is added to this list and DeepInfra, which no longer serves any route, is removed. Every other model keeps zero data retention with data collection denied; GPT-6 Luna Decisions remains the existing OpenAI exception.
Configured but not in use
Supabase. An earlier identity path. It is paused: the active identity provider is the self-hosted PostgreSQL one listed above. Configuration for it still exists in the codebase, so we list it rather than let a reviewer find it and wonder. It handles no data today.
Changes and objections
- New subprocessors are published here with at least 30 days' notice before they begin handling data, and account contacts are emailed.
- If you object to a new subprocessor on reasonable grounds, tell us during the notice period. If we cannot avoid it for your account, you may end the agreement without penalty — see ending the agreement.
- A change forced on us by a security incident may take effect immediately. We will publish it and say why within 5 business days.
Modelvia is a single-instance private pilot. See service levels for what that means for availability, and status for what the gateway is reporting right now.