Legal

Third-Party Services & Subprocessors

This document lists active third-party services and subprocessors used by Oflo that process customer data. This disclosure is provided for transparency. SOC 1/2 is still in progress. See the Delve Trust Center for current status. See the Delve Trust Center for current status.

Last Updated: October 2026

Data Processing Summary

We process the following categories of data through our third-party service providers:

Personal Identifiable Information (PII): Names, emails, phone numbers, addresses
Authentication Data: OAuth tokens, session tokens, API keys (encrypted)
Business Data: Company information, leads, campaigns, marketing data
Content Data: User-generated content, AI-generated content, files, media
Usage Data: Analytics events, error logs, performance metrics
Payment Data: Tokenized payment information (via Stripe)
Communication Data: Email content, SMS/WhatsApp content, message data

Data Storage Locations: Primary database (MongoDB), file storage (Google Cloud Storage), vector search (Weaviate), full-text search (Typesense), application hosting (Vercel global edge network). PostgreSQL (Neon) and Redis (Upstash) when configured.

Data Transmission: All integrations use encrypted connections (HTTPS/TLS). API keys are stored encrypted in the database. OAuth tokens are securely managed through integration platforms.

Authentication & User Management

NextAuth.js

Purpose: Primary authentication and session management

Data Processed: User sessions, OAuth tokens (when applicable)

Integration Type: OAuth 2.0 / Credentials (via NextAuth providers)

Google OAuth

Purpose: OAuth authentication provider (via NextAuth)

Data Processed: User authentication, basic profile information (as provided by Google)

Integration Type: OAuth 2.0

Auth Gateway (enterprise SSO)

Purpose: Optional JWT-based enterprise authentication gateway when AUTH_GATEWAY_ENABLED is set

Data Processed: Gateway JWT claims used to resolve or create local user accounts

Integration Type: JWT verification (issuer + public key)

Note: Used only for enterprise deployments that enable the auth gateway

Cloudflare Turnstile

Purpose: Bot protection on public forms (sign-in, book demo, feedback)

Data Processed: Challenge tokens and request metadata for verification

Integration Type: Bot management API

Database & Data Storage

MongoDB

Purpose: Primary database for application data

Data Processed: User data, organizations, leads, campaigns, integrations, file metadata

Integration Type: Database service (multi-tenant with separate databases per tenant)

Supabase

Purpose: Additional database/storage for selected product features

Data Processed: Application data for specific use cases (e.g. investor search)

Integration Type: Database API

Weaviate

Purpose: Vector database for AI/ML and semantic search operations

Data Processed: Vector embeddings, search data

Integration Type: Vector database API

Typesense

Purpose: Full-text and faceted search indexes

Data Processed: Indexed document content for search results

Integration Type: Search engine API

Neon (PostgreSQL)

Purpose: PostgreSQL data access layer for selected platform features when configured

Data Processed: Application records stored in Postgres schemas (tenants, users, orgs, licenses)

Integration Type: Managed PostgreSQL

Note: Used when NEON_DATABASE_URL is configured; MongoDB remains the primary store

Upstash Redis

Purpose: Caching and rate limiting

Data Processed: Rate-limit counters, cache keys, short-lived operational metadata

Integration Type: Redis API

Cloud Storage & File Management

Google Cloud Storage (GCS)

Purpose: File storage for user uploads, images, videos, documents

Data Processed: User-uploaded files, generated content, media assets

Integration Type: Cloud storage API

Google Cloud Tasks

Purpose: Background task queue management

Data Processed: Task metadata, job scheduling

Integration Type: Cloud service API

Payment Processing

Stripe

Purpose: Payment processing, subscription management, billing

Data Processed: Payment card information (tokenized), billing information, subscription data, webhook events

Integration Type: Payment API, Webhooks

Note: PCI DSS compliant service

Communication Services

SendGrid

Purpose: Email delivery service

Data Processed: Email content, recipient addresses, delivery status

Integration Type: Email API (configurable via API keys)

Resend

Purpose: Email API and domain authentication support

Data Processed: Email content, recipient addresses

Integration Type: Email API (configurable via API keys)

Twilio

Purpose: WhatsApp alerts, SMS, and related messaging

Data Processed: Phone numbers, message content (e.g. OTP and notification templates)

Integration Type: Communication API (platform credentials and configurable keys)

Nodemailer

Purpose: SMTP email sending for custom SMTP configurations

Data Processed: Email content, SMTP credentials (encrypted)

Integration Type: SMTP client

AI & Machine Learning Services

OpenAI

Purpose: AI language models, text generation, embeddings, transcription

Data Processed: User prompts, generated content, conversation data, audio for transcription

Integration Type: AI API (configurable via API keys / gateway)

Anthropic (Claude)

Purpose: AI language models and text generation

Data Processed: User prompts, generated content

Integration Type: AI API (configurable via API keys / gateway)

Google Gemini AI

Purpose: AI language models, multimodal analysis, media generation helpers

Data Processed: User prompts, generated content, website or media content for analysis

Integration Type: AI API (configurable via API keys / gateway)

Vercel AI Gateway

Purpose: Optional routing layer for multi-provider AI model fallbacks

Data Processed: Model requests and responses when gateway mode is enabled

Integration Type: AI gateway API

FAL.ai

Purpose: AI image and video generation

Data Processed: Image/video generation prompts, generated media

Integration Type: AI API

HeyGen

Purpose: AI video generation with avatars

Data Processed: Text input, video generation requests, generated videos

Integration Type: AI API

Voice & Speech Services

Deepgram

Purpose: Voice transcription and speech-to-text

Data Processed: Audio recordings, transcribed text

Integration Type: Voice API

ElevenLabs

Purpose: Speech-to-text, text-to-speech, and conversational voice agents

Data Processed: Audio recordings, transcribed text, synthesized speech, call conversation data

Integration Type: Voice API (platform and workspace credentials)

Analytics & Monitoring

PostHog

Purpose: Product analytics, user behavior tracking, feature flags

Data Processed: User interactions, page views, events, user properties

Integration Type: Analytics API

Mixpanel

Purpose: Product analytics and event tracking

Data Processed: User interactions, events, user properties

Integration Type: Analytics API

Sentry

Purpose: Error tracking, performance monitoring, application monitoring

Data Processed: Error logs, stack traces, performance metrics, user context

Integration Type: Error tracking API

Google Analytics

Purpose: Website analytics and traffic analysis

Data Processed: Page views, user interactions, traffic data

Integration Type: Analytics script (gtag.js / GTM)

Vercel Analytics & Speed Insights

Purpose: Web performance and usage analytics on Vercel-hosted pages

Data Processed: Aggregated performance and traffic metrics

Integration Type: Platform analytics

Background Jobs & Workflow Automation

Inngest

Purpose: Event-driven background job processing, workflow automation

Data Processed: Event data, job metadata, workflow state

Integration Type: Background job service API

Real-time Collaboration

Liveblocks

Purpose: Real-time collaboration, presence tracking, collaborative editing

Data Processed: User presence, cursor positions, collaborative data

Integration Type: Real-time API

Pusher

Purpose: Real-time notifications, presence tracking, event broadcasting

Data Processed: User presence, notification data, real-time events

Integration Type: Real-time messaging API

Integration Platforms & APIs

Composio

Purpose: Unified integration platform for connecting to external services

Data Processed: OAuth tokens, integration configurations, API responses

Integration Type: Integration platform API

Note: Connected services may include Gmail, Google Calendar, Google Drive, Google Docs, Google Meet, Google Analytics, Slack, Twitter/X, Instagram, LinkedIn, Facebook, and others the workspace authorizes

Social Media & Marketing Platforms

Purpose: Social media integration, lead generation, content posting

Data Processed: Profile data, connection data, posts

Integration Type: OAuth, API (via Composio and direct OAuth)

Twitter/X

Purpose: Social media integration, content posting

Data Processed: Tweets, profile data, engagement metrics

Integration Type: OAuth, API (via Composio and direct integration)

Facebook/Meta

Purpose: Social media integration, advertising, Graph API publishing

Data Processed: Posts, profile data, ad data

Integration Type: OAuth, API

Instagram

Purpose: Social media integration, content management, autopilot publishing

Data Processed: Posts, stories, profile data, webhook events

Integration Type: OAuth, API, Webhooks (via Composio and direct integration)

Data & Lead Generation

People Data Labs (PDL)

Purpose: Lead generation, people search, contact enrichment

Data Processed: Person data, company data, contact information

Integration Type: API (configurable via API keys)

Tavily

Purpose: Web search for lead and account intelligence enrichment

Data Processed: Search queries and publicly available web results

Integration Type: Search API

Firecrawl (Mendable)

Purpose: Web scraping and content extraction for brand research and enrichment

Data Processed: Website content, scraped data

Integration Type: API

Webhook & Event Management

Slack Webhooks

Purpose: Internal notifications and alerts

Data Processed: Notification messages, alert data

Integration Type: Webhook

Cloud Infrastructure & Hosting

Vercel

Purpose: Application hosting, deployment, edge functions

Data Processed: Application code, environment variables, deployment data, request logs

Integration Type: Platform as a Service (PaaS)

Google Cloud Platform (GCP)

Purpose: Cloud infrastructure, storage, and task queues

Data Processed: Application data, files, compute resources

Integration Type: Cloud platform

Note: Services used: Cloud Storage, Cloud Tasks

Development & Build Tools

GitHub

Purpose: Source code repository, version control, CI-related workflows

Data Processed: Source code, commit history

Integration Type: Version control system (via Vercel deployments and agent tooling)

Compliance & Security Notes

PCI DSS Compliance

Payment card data is processed exclusively through Stripe, a PCI DSS Level 1 compliant service provider. No card data is stored on our systems.

Data Encryption

Data in transit: All API communications use TLS/HTTPS
Data at rest: Database encryption, encrypted file storage

API Key Management

API keys can be configured per workspace/organization. Keys are stored encrypted in the database with fallback to environment variables for system-level keys.

Multi-Tenancy

Separate databases per tenant for data isolation. Workspace-based access controls and tenant-specific configurations ensure proper data separation.

Webhook Security

All webhooks use signature verification. Stripe webhook signature validation ensures authenticity.

This document is reviewed and updated quarterly, or when significant changes are made to our data processing practices. Compliance status updates are reflected in the Delve Trust Center.

For questions about our third-party services, please contact security@startuped.ai

Last updated: October 2026

Third-Party Services & Subprocessors

Last Updated: October 2026

Data Processing Summary

We process the following categories of data through our third-party service providers:

Personal Identifiable Information (PII): Names, emails, phone numbers, addresses

Authentication Data: OAuth tokens, session tokens, API keys (encrypted)

Business Data: Company information, leads, campaigns, marketing data

Content Data: User-generated content, AI-generated content, files, media

Usage Data: Analytics events, error logs, performance metrics

Payment Data: Tokenized payment information (via Stripe)

Communication Data: Email content, SMS/WhatsApp content, message data

Data Transmission: All integrations use encrypted connections (HTTPS/TLS). API keys are stored encrypted in the database. OAuth tokens are securely managed through integration platforms.

Database & Data Storage

MongoDB

Purpose: Primary database for application data

Data Processed: User data, organizations, leads, campaigns, integrations, file metadata

Integration Type: Database service (multi-tenant with separate databases per tenant)

Supabase

Purpose: Additional database/storage for selected product features

Data Processed: Application data for specific use cases (e.g. investor search)

Integration Type: Database API

Weaviate

Purpose: Vector database for AI/ML and semantic search operations

Data Processed: Vector embeddings, search data

Integration Type: Vector database API

Typesense

Purpose: Full-text and faceted search indexes

Data Processed: Indexed document content for search results

Integration Type: Search engine API

Neon (PostgreSQL)

Purpose: PostgreSQL data access layer for selected platform features when configured

Data Processed: Application records stored in Postgres schemas (tenants, users, orgs, licenses)

Integration Type: Managed PostgreSQL

Note: Used when NEON_DATABASE_URL is configured; MongoDB remains the primary store

Upstash Redis

Purpose: Caching and rate limiting

Data Processed: Rate-limit counters, cache keys, short-lived operational metadata

Integration Type: Redis API

Compliance & Security Notes

PCI DSS Compliance

Payment card data is processed exclusively through Stripe, a PCI DSS Level 1 compliant service provider. No card data is stored on our systems.

Data Encryption

Data in transit: All API communications use TLS/HTTPS
Data at rest: Database encryption, encrypted file storage

API Key Management

API keys can be configured per workspace/organization. Keys are stored encrypted in the database with fallback to environment variables for system-level keys.

Multi-Tenancy

Separate databases per tenant for data isolation. Workspace-based access controls and tenant-specific configurations ensure proper data separation.

Webhook Security

All webhooks use signature verification. Stripe webhook signature validation ensures authenticity.