Public providers
5 named providers
Provider names and approved policy links are listed below when public disclosure is approved.
SUBPROCESSORS
Subprocessors
Review the third-party providers approved for public disclosure and the additional provider categories available during qualified review. Deployment-specific infrastructure details may require security or procurement review.
- Terms of Service
- Privacy Policy
- Cookie Policy
- Data Processing Overview
- Subprocessors
- Security Overview
- Trust Center
- Contact legal/privacy
- Public disclosure list
- Qualified review material
- Privacy and Data Processing Overview context
What is a subprocessor?
A subprocessor is a third-party provider engaged by Verbum to process customer data as part of delivering the Service. Subprocessors only process data to the extent necessary to perform their specific function. Customers can request additional detail as part of legal, privacy or procurement review.
PROCUREMENT REVIEW
Additional subprocessors and infrastructure details
Additional deployment-specific provider details, processing purposes and regional context can be shared with qualified customers during enterprise security review, subject to the appropriate confidentiality process.
Review materials can be paired with Data Processing Overview context, Trust Center resources, Security overview, Privacy Policy and subprocessors documentation for privacy and enterprise vendor review.
Available during reviewOn request
- Additional deployment-specific provider details and processing purposes
- Data categories by provider
- Regional processing details, where applicable
- Data Processing Overview and subprocessors documentation
- Security control review materials
- security control mapping
- Protected evidence materials
Subprocessor disclosure
This disclosure separates providers approved for public naming from additional provider categories available during qualified security, privacy or procurement review. It is not a complete deployment-specific provider list.
Stripe is disclosed for paid checkout and billing. AWS and Microsoft Azure are disclosed as deployment-specific or service-specific cloud providers: a customer deployment may use AWS, Azure or both for different approved service functions depending on architecture and region, and exact use is confirmed during qualified review. OpenAI is disclosed only where AI-assisted features are enabled for an approved workspace scope. Authentication, monitoring, analytics and support/procurement provider details remain available during qualified review until provider names, scope and regional details are approved for public disclosure.
PROCUREMENT VIEW
What this disclosure gives your vendor review team
Use the public table for named providers and policy links. Use the review-only table to identify provider categories that may require a qualified review path before provider names, regions or deployment-specific context can be shared.
- Disclosure status
- Review availability
- Confidentiality requirement
Review-only categories
4 protected categories
Provider categories are visible publicly; confidential provider names remain available only through qualified review.
Review availability
Qualified review
Procurement, privacy and security teams can request deployment-specific provider context.
NDA availability
May apply
Sensitive provider details may require NDA or an appropriate confidentiality process.
Publicly disclosed providers
Public provider information is listed separately from service categories that require qualified review. Protected provider names remain available only through the qualified review path.
| Service category | Provider | Purpose | Data category | Region/location | Status | Review note | Policy link |
|---|---|---|---|---|---|---|---|
| Payments | Stripe | Subscription billing and payment processing. | Billing contact, payment method details, payment processor identifiers and subscription identifiers. | Depends on Stripe processing and customer billing configuration. | Publicly disclosed payment processor | Public page and qualified procurement review | |
| Cloud infrastructure | Amazon Web Services, Inc. | Hosting, compute, storage, secrets management and platform resilience for deployments or services configured to use AWS. | Customer workspace data, message records, audit events, operational metadata, secrets metadata and platform logs needed to operate the service. | Deployment-specific AWS region; confirmed during qualified security or procurement review. | Publicly disclosed cloud infrastructure provider | Public page and qualified security review | |
| Cloud infrastructure | Microsoft Corporation | Microsoft Azure platform services used for cloud infrastructure and related service delivery for deployments or services configured to use Azure. | Customer workspace data, message records, audit events, operational metadata and platform logs needed to operate the service. | Deployment-specific Azure region; confirmed during qualified security or procurement review. | Publicly disclosed cloud infrastructure provider | Public page and qualified security review | |
| Email/communications | Microsoft Corporation | Azure communications services used for operational messages, account notifications, support communications or security/procurement follow-up where configured. | Business contact details, message metadata and communication content submitted through Verbum forms or operational workflows. | Deployment-specific Azure communications region; confirmed during qualified privacy, security or procurement review. | Publicly disclosed communications provider | Public page and qualified privacy review | |
| AI processing | OpenAI | AI-assisted draft generation, summarization or routing support where OpenAI services are enabled for an approved workspace scope. | Message context, prompts or inputs, generated drafts, workflow metadata and provider configuration context. | Provider processing locations and transfer context are confirmed during qualified security or privacy review for the approved workspace scope. | Publicly disclosed AI processing provider | Public page and qualified security review |
Review-only categories
Additional providers available during qualified review. These categories identify provider areas that may apply to a deployment. Provider names, regional details and deployment-specific context are disclosed only through the qualified review path. No confidential provider name is published here.
| Service category | Disclosure status | Purpose | Data category | Region context | Deployment condition | Review availability | Confidentiality requirement | Last reviewed |
|---|---|---|---|---|---|---|---|---|
| Authentication | Review-only category | Identity, access management, authentication workflows and SSO-related controls where configured. | User profile data, workspace identifiers, access metadata and authentication events. | Provider and regional details depend on workspace configuration and review scope. | Conditional provider category. Applies only where authentication, identity or SSO tooling is configured for the applicable workspace. | Available during qualified security review | Provider details are available to qualified customers during security review, subject to the appropriate confidentiality process. | June 19, 2026 |
| Observability/security monitoring | Review-only category | Platform reliability monitoring, diagnostics, security alerting and incident investigation support. | Operational logs, security events, access metadata, error traces and limited diagnostic context. | Deployment-specific processing and transfer details are reviewed under the security process. | Conditional provider category. Applies only where monitoring, diagnostics, alerting or incident review tooling is configured for the deployment. | Available during qualified security review | Provider details are available to qualified customers during security review, subject to the appropriate confidentiality process. | June 19, 2026 |
| Analytics, where enabled | Review-only category | Product usage analysis, conversion measurement and operational reporting where analytics is approved and enabled. | Usage events, page or product interactions, device/browser context and non-sensitive operational metadata where enabled. | Provider details are reviewed if analytics is enabled for the applicable environment. | Not currently active on the public website without approved analytics provider configuration and consent gating. | Available during qualified security review if analytics is enabled | Provider details are available to qualified customers during security review when analytics is enabled, subject to the appropriate confidentiality process. | June 19, 2026 |
| Support/procurement tooling | Review-only category | Customer support, vendor questionnaires, legal/security review workflow and procurement communications. | Support tickets, procurement communications, legal/security review context and business contact details. | Provider and region details may vary by review workflow and are shared through the qualified review process. | Conditional provider category. Applies only where support, legal review or procurement workflow tooling is configured. | Included in qualified security package when applicable | Provider details are available to qualified customers during security review, subject to the appropriate confidentiality process. | June 19, 2026 |
Trust context for procurement review
Subprocessor review can be evaluated alongside Verbum security and privacy materials available to qualified customers and enterprise evaluators.
SOC 2 Type II report: qualified reviewISO/IEC 27001:2022 evidence review: qualified reviewLGPD + GDPR privacy program: qualified reviewApplication security controls aligned with OWASP ASVS: qualified reviewPenetration testing review materials: qualified reviewSecurity control materials for qualified reviewPrivacy documentation and DPA context
How we manage subprocessors
Verbum maintains a controlled subprocessor review process that supports privacy reviews under LGPD and GDPR-aligned data processing requirements.
- Material subprocessors are reviewed for security and privacy relevance.
- Subprocessors are documented for legal, privacy and procurement review.
- Customer-facing providers are disclosed where applicable.
- Enterprise customers can request additional details during security review.
Changes to this document
Last updated: June 19, 2026. Effective date: June 16, 2026. We may update this document to reflect product, operational, legal or regulatory changes. Material updates will be communicated where required by applicable law or contract.
Use the procurement/security contact path to request review of subprocessor changes. Verbum can share additional provider names, data categories, regional context and transfer details during qualified review, subject to NDA.
A fixed advance notice period or contractual objection right is stated only when defined by the applicable DPA, order form or approved legal policy.
- June 19, 2026Added AWS, Microsoft Azure and OpenAI to the public subprocessor disclosure.
- June 16, 2026Published initial public Stripe disclosure and qualified-review provider categories.
Need a privacy or procurement review?
Contact Verbum to review subprocessors, DPA review context, security documentation and deployment-specific vendor details.