Last updated: 23 October 2026
NORIA GROUP Ε.Ε. ("Noria", "we") uses the service providers below to run Orestia.
- When we process event data on behalf of a planner, the providers marked "Event data" are our sub-processors under the Data Processing Agreement (Clause 7.7 and Annex IV).
- When we process account, billing and support data as controller, the providers act for us as described in the Privacy Policy (sections 10 and 11).
We will update this page and tell customers in writing at least 30 days before we add or replace a provider that processes event data, so that they can object (DPA Clause 7.7).
| Provider | Purpose | Data | Location | Transfer mechanism | Applies to | Official sources |
|---|---|---|---|---|---|---|
| Supabase (Supabase Pte. Ltd., Singapore) | Database, sign-in and file storage for Orestia | All event data: messages, attachments, transcripts, the event ledger, drafts. Account data | Project in Central EU (Frankfurt), eu-central-1: database, Auth, Storage objects and backups stay in that region. Logs are stored in EU-based data centres. Account, billing, telemetry and support data may be processed outside the region (Singapore, United States) | EU Standard Contractual Clauses (Module 2 and Module 3) incorporated in the Supabase DPA, Version 1, 1 August 2026; acceptance of the terms has the effect of signing the SCCs. UK and Swiss addenda | Event data; account data | DPA · Data residency and transfers · Regions · Sub-processor list |
Google Cloud: Vertex AI (Gemini Enterprise Agent Platform), Claude models by Anthropic through the eu multi-region endpoint; contracting entity as named in our Google Cloud agreement | AI coordinator processing: extracting facts with receipts, preparing drafts, summaries, translations and quote comparisons | Message content, attachments, transcripts and event data sent in each request | Europe multi-region endpoint (aiplatform.eu.rep.googleapis.com). Google states that ML processing happens within the EU for requests to its European endpoints. Anthropic states that on Google Cloud "the cloud provider is the data processor" | Google Cloud Data Processing Addendum. For transfers to the United States Google uses the EU-US Data Privacy Framework (Google LLC is certified) as its Alternative Transfer Solution since 1 September 2023; otherwise the SCCs in the Addendum | Event data | Claude on Google Cloud · Sonnet 5.5 locations · Quotas and EU processing · Cloud DPA · Alternative Transfer Solution · Data governance |
Amazon Web Services: Amazon SES (and S3 for stored messages), region eu-central-1; contracting entity as named in our AWS agreement | Receiving emails forwarded to Orestia addresses ("forward to the coordinator"); sending notifications | Forwarded emails and attachments; email addresses and notification content | Receiving and sending in Europe (Frankfurt), eu-central-1. Storage bucket configured in the same region | AWS Data Processing Addendum incorporated in the AWS Service Terms; EU SCCs (Implementing Decision (EU) 2021/914) incorporated for transfers outside the EEA | Event data | SES endpoints and receiving regions · Service Terms · GDPR center |
| Vercel (Vercel Inc., Delaware, United States) | Hosting the web app and running its server functions | Requests and responses, including event data in transit; technical logs | Functions run in the region we configure: fra1 (Frankfurt) ; the default is the United States. Static content is cached worldwide. "Vercel's primary processing facilities are in the United States", its core database is globally replicated, and Vercel "may transfer data to and in the United States". Data does not stay only in the EU. Event data is stored in Supabase, not in Vercel | EU SCCs (Implementing Decision (EU) 2021/914, Modules 1 to 3) and the UK Addendum in the Vercel DPA (effective 31 March 2026). Vercel is certified under the EU-US Data Privacy Framework | Event data (in transit); account data | DPA · Compliance and data location · Function regions · Sub-processors |
| Stripe (entity named in our Stripe services agreement ; transfers to Stripe, LLC, United States) | Billing and payments for Orestia subscriptions | Billing contact, billing address, VAT number, subscription and payment status, invoices. Card details are collected and held by Stripe | Stripe entity per agreement; personal data may be transferred to Stripe, LLC in the United States | Stripe Data Transfers Addendum: EU-US Data Privacy Framework (Stripe, LLC is certified), EEA SCCs (Implementing Decision (EU) 2021/914), UK International Data Transfer Addendum. Stripe acts as processor for some purposes and as independent controller for others | Account and billing data only (not event data) | DPA · Privacy policy · Service providers |
| ElevenLabs (entity named in the ElevenLabs terms ) | Voice: text to speech for the daily brief; speech to text for voice notes | Text of the brief (event data); audio of voice notes and their transcripts | Customer data is stored in the United States by default. EU data residency is "an Enterprise feature": an isolated environment (api.eu.residency.elevenlabs.io) where storage is in the EU but "processing may nevertheless occur outside of the selected location", unless Zero Retention Mode is used ("available to select enterprise customers"). Self-serve, used only for demonstrations with sample data. No customer audio or text is sent to ElevenLabs | ElevenLabs DPA (last updated 8 April 2026): EEA SCCs (Implementing Decision (EU) 2021/914), UK Addendum, Swiss modifications; transfers may also rely on the EU-US Data Privacy Framework | Event data | DPA · Data residency · Zero Retention Mode · Sub-processors |
| Team email: Google Workspace | Our team's mailboxes: support, privacy requests, messages you send us and communication with customers | Emails with customers and prospects; support requests, which may contain event data that a customer chooses to send | Business Standard with the Europe data region: data regions (Europe) are available only from Business Standard upwards, not on Business Starter | Cloud Data Processing Addendum (covers Google Workspace) with Google's Alternative Transfer Solution (Data Privacy Framework) or SCCs | Account and support data; event data only when a customer sends it to support | Workspace data regions · Cloud DPA |
Where our infrastructure is
- Location. Event data is stored in data centres in Frankfurt, Germany (Supabase, and Amazon Web Services for forwarded email). AI processing runs in Google Cloud's EU multi-region. Our web functions run in Frankfurt (Vercel
fra1), and requests pass through Vercel's global network. - Which law applies to the providers. Supabase is a Singapore company. Google, Amazon Web Services, Vercel and Stripe are, or belong to, groups based in the United States. Besides EU law, the law of those countries can apply to them.
- Measures against unlawful access by governments outside the EU. Encryption in transit and at rest, access limited by workspace and role, and a written contract with each provider under our Data Processing Agreement. If an authority outside the EU asks us for customer data, we disclose it only where EU or Greek law allows it, and we tell the customer first unless the law forbids it.
Not sub-processors
- The services behind the channels you choose to connect. Google (Gmail, Google Drive and Sheets), Microsoft (Outlook), Meta (WhatsApp Business Platform and Instagram), Telegram, Quo and Dropbox are services the planner chooses to use under the planner's own agreements with those providers. They are not engaged as our sub-processors for those connections. Orestia accesses them only with the planner's authorisation, as described in the Privacy Policy, section 4. A Google, Apple, Microsoft or other calendar service chosen by the planner receives only the selected approved schedule projection through a private subscription link; revoking the link does not erase downloaded copies. Google Cloud Vertex AI and our team Google Workspace remain separate provider roles in the table above.
- Anthropic's own API. We use it only for demonstrations and evaluations with synthetic or anonymised data, never with customer data.
- Planned, not in use. Error monitoring, product analytics, AI quality monitoring and support chat are not in use. Before we use any of them with event data, we will add them to this page with notice.