Security
Sub-processors
Third parties Traivr uses to deliver the platform, what each processes, and where.
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Vercel Inc. | Application hosting and content delivery | All platform traffic, including request logs (IP addresses) | United States (global edge network) |
| Neon Inc. | Managed PostgreSQL database | All platform data at rest, including account and payment-account records | United States |
| Resend Inc. | Transactional email delivery | Recipient email addresses and message content (verification, notifications) | United States |
| Google LLC | OAuth sign-inOnly for accounts using Google sign-in | Email address and profile name of accounts that choose Google sign-in | United States |
| Stripe, Inc. | Payment processing and payoutsWhen Stripe payouts are enabled | Payout account identifiers and transaction amounts | United States |
| Safaricom PLC (M-Pesa) | Mobile-money payoutsWhen M-Pesa payouts are enabled | Payout phone numbers and transaction amounts | Kenya |
| Upstash, Inc. | Rate-limit countersWhen shared rate limiting is enabled | Short-lived request counters keyed by IP address or hashed API key | United States |
Each sub-processor is bound by a data processing agreement with terms no less protective than our own commitments to customers. We review this list before adding any vendor that would process customer or trainer personal data.
Change notice: customers with a data processing agreement in place are notified by email at least 30 days before a new sub-processor begins processing their data, with the opportunity to object.
Questions about this register or our data practices: support@traivr.com.
Last updated: August 26, 2026.