Each subprocessor is bound by data processing terms consistent with applicable data protection law. Customers will be notified with a minimum of 30 days notice before any material addition to this list.
Core infrastructure
| Subprocessor | Role | Data processed | Region | Compliance |
|---|---|---|---|---|
| Supabase (on AWS) | Database, authentication, file storage, secrets vault | All customer data at rest | Customer-selectable (US by default) | SOC 2 Type II, ISO 27001 |
| Vercel | Application hosting, serverless functions, CDN | Request/response in transit - no persistent storage | US (edge: global) | SOC 2 Type II |
AI services
| Subprocessor | Role | Data processed | Region | Compliance |
|---|---|---|---|---|
| Anthropic | AI inference engine (Nova assistant) | Query context sent per request. Zero data retention - not used for model training. | US | SOC 2 Type II |
Anthropic's zero data retention policy means no customer data is stored or used to improve Anthropic's models. This is enforced at the API contract level and is independently verifiable in Anthropic's published usage policies.
Alternative model providers (OpenAI, Google) or an in-VPC / self-hosted model can be engaged at a customer's request. Any provider engaged on a customer's behalf runs under the same zero-retention terms and is added to this list with a minimum of 30 days notice.
Observability
| Subprocessor | Role | Data processed | Region | Compliance |
|---|---|---|---|---|
| Sentry | Error monitoring and alerting | Stack traces and error metadata only. No financial data or PII. | US | SOC 2 Type II |
| Ybug | In-app bug and feedback reporting | Only what a user chooses to send in a report: a screenshot of the current screen, the page address, browser details, the user's comment, and the console and network logs from that page. A report can show on-screen customer data. | EU (Germany) | GDPR |
Communications
| Subprocessor | Role | Data processed | Region | Compliance |
|---|---|---|---|---|
| Resend | Transactional and product email delivery | Recipient email address and name only. No financial data. | US | SOC 2 Type II |
| Slack | Notification and digest delivery (customer-connected) | Slack workspace and user identity, plus the alert or report content the customer chooses to send. Engaged only when a customer connects Slack. | US | SOC 2 Type II, ISO 27001 |
Integration connectors (customer-configured data sources)
These are the customer's own source systems, connected only when the customer explicitly configures the integration. They are data sources Novaplan reads from under the customer's control, not Novaplan sub-processors. Each integration is customer-initiated, and Novaplan reads only a fixed, allowlisted set of fields; fields outside that list are never pulled.
The systems below are representative examples, not an exhaustive list. Novaplan can ingest from any source a customer chooses to connect: a direct file upload, an HR, ERP, or CRM system, a data warehouse, or an API. Every connection is scoped to the tables and fields the customer explicitly grants.
| System | Role | Fields ingested |
|---|---|---|
| HiBob | HR data source | Employee name, job title, department, employment status, start/termination date, FTE, compensation |
| BambooHR | HR data source | Same as HiBob above |
| NetSuite | ERP / GL actuals | Accounts, posted amounts, vendors, departments, accounting periods |
| Snowflake | Data warehouse | Customer-configured - scoped to tables and columns the customer explicitly grants |
| Google Sheets / Drive | Spreadsheet and file data source | Customer-configured - scoped to the sheets and files the customer explicitly grants |
Novaplan does not require sensitive personal data. Its standard HR and ERP connectors exclude SSN, bank or payment details, home address, and medical or benefits data; customer-granted sources such as a data warehouse are scoped by the customer.
What Novaplan does not use
- No advertising or analytics platforms with access to customer data
- No data brokers or data enrichment services
- No offshore processing outside the regions listed above
Changes to this list
Material additions or changes to subprocessors will be communicated to customers with a minimum of 30 days notice, during which customers may raise objections in writing to security@getnovaplan.com.