This page lists the third parties Aventro uses to provide the Service. Locations reflect verified production configuration for active services. Inactive or conditional services are identified as such and will be updated before activation. Region information for services with a verified location was last confirmed on 20 July 2026.
A. Subprocessors (process personal data on our behalf)
We engage the following subprocessors to provide the Service. Each processes personal data under data-protection terms consistent with our DPA.
Subprocessor | Purpose | Personal data processed | Region |
|---|---|---|---|
OpenAI | AI analysis, scoring, verification, report generation and the in-product assistant. OpenAI models, served by OpenAI or by Microsoft Azure, reached through Vercel AI Gateway with zero data retention required on every request | Intake data, evidence content and the text of deal emails forwarded to a fund's address, submitted for analysis; may include personal data within them | Chosen for each request by Vercel AI Gateway (global routing, not pinned to one region) |
TypeSafe AI | Fast typed readings of short text (which of a fixed set of answers a message or passage gives) for the in-product assistant and the mandate interview: typed readings of short text, reached through Vercel AI Gateway with zero data retention required on every request. Not used to train models | Short excerpts sent for a reading: an assistant chat message, a mandate-interview answer, or the passage a question is about; may include personal data within them | United States |
Microsoft | Transcription of the recordings of calls that users add: Microsoft's transcription model, served on Azure, reached through Vercel AI Gateway with zero data retention | The sound of a call a user adds, sent once to be turned into text; it may include the voices and words of the people on the call. Never used to identify anyone by their voice | Chosen for each request by Vercel AI Gateway (global routing, not pinned to one region) |
Supabase | Database, authentication, storage, real-time | Account data, Deal and evidence data, collaboration content, files | Frankfurt, Germany (eu-central-1) |
Vercel | Application hosting; routing of requests to the AI models (AI Gateway, zero data retention); performance/usage measurement (Analytics, Speed Insights), only with analytics consent: page views and a few explicit product events | Usage and device data; approximate location from IP; intake data and evidence content passing through to the AI models | United States / global edge |
Render | Background compute for analysis and report generation | Evidence and intake content processed during analysis | Frankfurt, Germany |
Cloudflare | Off-platform storage of encrypted backup archives | Encrypted copies of the database and stored files, including evidence and reports; readable only with a key Cloudflare does not hold | European Union |
Exa | Web-search retrieval for verification and intelligence | Search queries, which may include company and individual names | United States |
Resend | Transactional, invitation and consented marketing email; inbound deal-flow email received at a fund's own address | Recipient name and email; message context. Inbound: sender address, subject, message and attachments, held by Resend until the Service fetches them | United States |
Polar | Checkout and payment for founder packs, as merchant of record. Card details are collected by Polar's payment processor (Stripe) and never reach Aventro | Buyer name, email and billing address; Aventro account ID; purchase record | United States (as declared by Polar) |
Sentry | Optional error monitoring and application diagnostics (not active in production) | None while inactive | Not active; no production processing location |
Conditional (enabled only where the relevant integration/credentials are configured):
Subprocessor | Purpose | Personal data processed | Region |
|---|---|---|---|
Professional-profile verification (OAuth, where a user connects it) | Profile identity (name, headline, profile URL, email where authorized) | United States / global |
Note: organization plans are invoiced and paid by bank transfer. Only founder packs are bought online, through Polar.
B. External data sources we query (verification)
These are public or third-party data sources the Service queries to verify claims. They return data (which can include personal data about founders, inventors, and executives) in response to our queries. They are not vendors processing your data on our behalf; each has its own terms. The complete current list, with what each source can and cannot confirm, is at aventro.ai/verification.
Source | Used for |
|---|---|
Company registers: Israeli Registrar of Companies, UK Companies House, SEC EDGAR, GLEIF, Brønnøysund Register Centre (Norway), Finnish Patent and Registration Office (PRH) | Company identity and registration; officers, directors and persons with significant control |
USPTO; EPO / Espacenet | Patent verification |
SEC EDGAR (filings and Form D) | US securities filings; named officers and directors |
GitHub | Engineering and technical signal |
Semantic Scholar | Research/publication verification |
Y Combinator (public data) | Accelerator claims |
Domain / DNS / WHOIS | Website and email-domain verification |
USAspending.gov, NASA TechPort, ClinicalTrials.gov, openFDA (only for companies in the relevant sector) | Federal awards, technology projects, registered clinical trials, device clearances |
The public web, searched through Exa | Funding history, team background, market and competitor context |
Changes
We update this page when we add or change subprocessors. Business customers who subscribe to notifications will receive advance notice and may object on reasonable data-protection grounds, as described in the DPA.
Contact
Aventro Ltd., Yigal Yadin 1/5, Ra'anana, Israel · privacy@aventro.ai
Questions about this document? Contact us at legal@aventro.ai