Oriora — Sub-processors
Last updated: 2026-05-26 Effective: 2026-05-26
This page lists the sub-processors Oriora engages when providing its services. The Oriora Data Processing Addendum governs the terms under which these sub-processors may be changed and the mechanism for customer objections.
AI vendors — not Oriora sub-processors
The AI providers whose models process your prompts — Anthropic, OpenAI, Google, and others in Oriora's catalog — are your third-party relationships, not Oriora's sub-processors. For Managed AI, content is transmitted to a provider under that provider's own terms; the specific provider may vary based on Oriora's routing. For BYOK, you hold a direct contractual relationship with your vendor; Oriora is an orchestration layer only.
Infrastructure sub-processors
The following entities process personal data on Oriora's behalf as part of the infrastructure required to deliver the service.
| Vendor | Location | Purpose |
|---|---|---|
| Supabase, Inc. | EU / US* | Database and authentication infrastructure. Stores account data, usage records, and application configuration. |
| Railway Corp. | US | Server runtime hosting. Processes all API requests including prompt content transmitted through Oriora's server. |
| Vercel, Inc. | US / Global edge | Landing page hosting only. Does not process prompt content or account transaction data. |
| Cloudflare, Inc. | US / Global edge | DNS resolution, CDN, email routing (inbound), edge WAF. Transient data only; does not persist personal data beyond standard log retention. |
| Resend, Inc. | US | Transactional email delivery (account confirmations, billing notices, system alerts). |
*Supabase project region affects where account and application data is stored. Oriora's current project region is documented in the internal connection registry. EU customers should contact support to confirm data-residency configuration.
Payment processing
Creem OÜ (Estonia) processes payment data as Merchant of Record and independent data controller — not as an Oriora sub-processor.
Notice of changes
Oriora will provide advance notice of any addition or replacement of sub-processors via the mechanism specified in the Oriora Data Processing Addendum. The notice period and objection process are governed by the DPA; the DPA notice period is shorter than 30 days because Oriora cannot bind its upstream infrastructure vendors to longer windows.
To raise a question or objection regarding sub-processors, contact: [email protected]