Subprocessors
This is a draft pending review. It may change before it is final. Questions: privacy@verilays.com.
These are the outside services that process your data for Verilays, where they are, and exactly what each one receives. The Data Processing Agreement in our Terms of Service says how we tell you before this list changes.
| Vendor | Country | Purpose | What it receives |
|---|---|---|---|
| Railway | Netherlands (EU West, Amsterdam) | Runs the proxy, the background services and the Redis queue between them. | Every call your agent sends through Verilays, as it passes through, and the records queued before they are stored. |
| Supabase | Germany (eu-central-1, Frankfurt) | The Postgres database, and sign-in for the dashboard. | Everything we keep about your agent's calls, listed in the Terms, and your account's email and sign-in data. |
| AWS S3 | Germany (eu-central-1, Frankfurt) | Stores full payload copies. | Full copies of calls, only on connections where payload capture is on. Each copy is deleted after 30 days. |
| Vercel | Germany (fra1, Frankfurt) | Hosts the dashboard and this website. | What the dashboard shows you, as it renders it. |
| OpenAI | United States | The analyzer's judge, which reviews how an agent is set up. | Your agent's system prompt and tool definitions (names, descriptions and parameters), and nothing else. |
| OpenRouter | United States | Replay, which re-runs conversations on a cheaper model, and the Jev judge, which grades conversations. | For replay: full conversations, only on connections where you turned replay on. For the Jev judge: each conversation's first question and final answer as we keep them, the tools it called and their error text, and any standards you wrote for the agent. |
Your own LLM provider also receives your agent's traffic, with your own key, exactly as it would without Verilays. It is your provider, not ours, so it is not listed here.