Overview
This page lists all third-party sub-processors that Cove (operated by Версей ЕООД / Versey EOOD, UIC 208443341) uses to process personal data on behalf of our customers. This list is maintained in accordance with Article 28 of the GDPR and our Data Processing Agreement.
We will update this page when sub-processors are added or changed. If you are a customer with a Data Processing Agreement, you will receive at least 30 days' advance notice of any changes to this list.
Infrastructure and Hosting
| Sub-processor | Purpose | Entity Location | Data Processing Location | |---|---|---|---| | Supabase, Inc. | Database hosting, user authentication, and file storage | United States | US / EU (configurable) | | Vercel, Inc. | Application hosting, edge compute, and serverless functions | United States | US / EU (edge network) |
AI and Document Processing
| Sub-processor | Purpose | Entity Location | Data Processing Location | |---|---|---|---| | Anthropic, PBC | AI-powered document extraction, classification, and data analysis via Claude API | United States | United States |
Communications
| Sub-processor | Purpose | Entity Location | Data Processing Location | |---|---|---|---| | Resend, Inc. | Transactional email delivery (invoice emails, verification codes, reminders) | United States | United States |
Inbound Email
Cove does not connect to any mailbox you own. Each organization is issued its own Cove address and you forward documents to it; this sub-processor receives that mail and holds it briefly so it can be processed.
| Sub-processor | Purpose | Entity Location | Data Processing Location | |---|---|---|---| | Amazon Web Services EMEA SARL | Receiving forwarded email and storing the raw message for up to 30 days | Luxembourg (EU) | EU (Frankfurt) |
Analytics and Consent
These sub-processors run on our website and application. Analytics is engaged only for visitors who accept the "Statistics" category in our cookie banner; see our Cookie Policy.
| Sub-processor | Purpose | Entity Location | Data Processing Location | |---|---|---|---| | PostHog, Inc. | Product analytics, session replay, and error and performance diagnostics (EU Cloud) | United States | EU (Germany) | | Usercentrics A/S (Cookiebot) | Cookie consent banner and consent record keeping | Denmark (EU) | EU |
Other Services
| Sub-processor | Purpose | Entity Location | Data Processing Location | |---|---|---|---| | Translated srl (MyMemory) | Text translation services | Italy (EU) | EU | | VATStack | VAT rate lookup and validation | EU | EU |
Data Transfer Safeguards
For sub-processors located outside the European Economic Area, we rely on the following transfer mechanisms:
- EU-US Data Privacy Framework (DPF): Applicable to Vercel, which is certified under the DPF
- Standard Contractual Clauses (SCCs): Applicable to Supabase, Anthropic, Resend, and PostHog, in accordance with Commission Implementing Decision (EU) 2021/914
- No transfer required: Amazon Web Services processes inbound email entirely within the EEA (Frankfurt)
- Transfer Impact Assessments (TIAs): Conducted for all transfers to non-EEA jurisdictions to evaluate and ensure adequate protection
Changes to This List
Last updated: August 9, 2026
To receive notifications about changes to our sub-processor list, contact us at filip@joincove.io.
Contact
If you have questions about our sub-processors or data transfers:
- Email: filip@joincove.io