At Vibranium Labs, we partner with a limited set of third-party service providers (“sub-processors”) to help deliver, support, and secure our products. We apply strict data governance and security standards when selecting and managing these partners.
We evaluate all sub-processors for security, privacy, and compliance readiness. Each provider must meet industry-standard requirements for data handling and protection, including:
We maintain data processing agreements with each sub-processor, including flow-down obligations that match our customer commitments.
| Sub-Processor | Purpose | Data Location | Notes |
|---|---|---|---|
| Amazon Web Services (AWS) | Infrastructure, database, and storage | United States | Aurora (PostgreSQL), S3, KMS |
| Auth0 (Okta) | Authentication and authorization | United States | Email, user identifiers, session tokens; short-lived JWTs |
| OpenAI | Language model inference (LLM) | United States | No training on customer data; BYO key option |
| Pinecone | Vector database for embeddings | United States | Logical namespace isolation per customer |
| Recall.ai | Meeting recordings and transcripts | United States | Used with customer approval only |
| Twilio | Email, SMS, and voice | United States | Vibe OnCall notifications and phone-call support |
| Stripe | Billing and payment methods | United States | Card numbers are not stored by Vibranium Labs |
Enterprise customers may also provide their own API keys for OpenAI, Recall.ai, or other integrations, ensuring that data never leaves their managed environments.
We will provide advanced notice of any new sub-processors at least 30 days prior to onboarding, unless required sooner for security or operational continuity. Customers can request additional detail or object to new sub-processors via [email protected].