Subprocessors
We keep our supplier chain deliberately short. The providers below are the ones the product actually depends on today, as far as the running code shows. Each processes customer data only to deliver the function described. We do not state a processing region or a transfer mechanism we cannot evidence: where a provider processes data outside the EEA, the UK or Switzerland, the applicable terms are that provider's own data-processing terms, and we will send you the current terms for a named provider on request.
Current subprocessors
- Lovable (application hosting, transactional and sign-in email, AI model routing)
- Serves the console and its server functions. Sends sign-in, billing and service-notice email through the Lovable email API, which the application code uses directly. Routes the text you submit to AI models for summaries and explanations through the Lovable AI gateway. Also receives diagnostic error events. We do not state a hosting or processing region for this provider, because we cannot verify one from our side.
- Supabase (managed database, authentication and file storage)
- Stores account records, company and regulatory records, mitigation steps, encrypted integration tokens and audit logs, and handles sign-in. The database region is fixed per instance; ask us and we will confirm the region for your account.
- Stripe (payment processing)
- Subscription billing, embedded checkout, invoices, tax handling and fraud prevention. Card data is processed by Stripe, not by us.
- Microsoft 365 (OneDrive / SharePoint)
- Only where you connect it, and only for ERP, broker and ACE files: we read the folders and files you select, on your instruction. Microsoft acts under your own Microsoft agreement; the tenancy and region are yours.
We do not state that a provider is barred from training models on your content unless that provider's own terms say so. If model-training terms matter to your assessment, write to us and we will point you at the current terms for the provider in question.
Changes and objection
We update this page before a new subprocessor starts processing customer data. Customers on an active subscription may subscribe to change notices by writing to us, and may object to a new subprocessor on reasonable data-protection grounds within 14 days of the notice.
If we cannot resolve a reasonable objection, you may terminate the affected subscription and receive a refund under the Refund and Cancellation Policy. Notices and objections: privacy@maatvia.com.