Customer Data providers
For new Plaid Identity Verification checks accepted under the October 27, 2026 notices, Plaid’s default session-data retention lasts for the active Identity Verification contract; its biometric policy describes storage of identity documents and face images for the business relationship, unless earlier deletion is required by law or legal process. See the Identity and Biometric Information Notice for manual redaction, biometric destruction requirements, and the prospective scope. Existing consent promises, Persona checks, and bank-check retention are unchanged.
| Provider | Function | Data that may be processed |
|---|---|---|
| Cloudflare | DNS, CDN, web application firewall, edge delivery, and encrypted object storage | IP and request data; encrypted transaction artifacts when the applicable storage feature is used |
| Render | Application hosting and managed database infrastructure | Account, service, transaction, and operational data needed to run Veto |
| Clerk | Customer-user authentication and account access | Name, work email, account identifier, authentication and security data |
| Persona | Optional identity, government-ID, and selfie workflow | Identity documents, selfie or video, derived identity or biometric signals, inquiry metadata, and result |
| Plaid | Optional read-only bank connection and account signals; optional identity, government-ID, and selfie workflow when Plaid is the provider identified before consent | Connection token, institution and account metadata, balances or activity exposed by the selected read-only product; identity documents, selfie or video, derived identity or biometric signals, inquiry metadata, and result for an enabled identity check |
| Twilio | SMS, voice, possession challenges, and call routing | Phone number, message or call metadata, transactional message content, and recording only when all required consent is recorded |
| Resend | Transactional email delivery | Email address, delivery metadata, and the content of the requested transactional message |
| Reducto | Optional document extraction for enabled workflows | The selected document and extracted fields needed for the workflow |
| Chatwoot | Customer support | Contact details, support messages, and attachments a user chooses to send |
| Sentry | Error monitoring and incident diagnosis | Scrubbed error, device, request, and performance telemetry; not intended to contain transaction content |
Website and business-operation providers
| Provider | Function | Data that may be processed |
|---|---|---|
| Cloudflare | Public-site hosting, DNS, CDN, security, and field-program intake infrastructure | IP and request data; submitted field-program application data |
| Plausible | Aggregate public-site analytics | Page and allowlisted event data; no free-text form fields or transaction content |
| Cal.com | Optional scheduling | Contact and appointment details a visitor chooses to provide |
How Veto uses providers
- Not every provider receives every customer’s data.
- A provider is used only for its listed function and an enabled feature.
- Veto requires written confidentiality, security, purpose, and data-protection terms.
- Veto does not authorize providers to sell Customer Data, use it for advertising, or train general-purpose models on it.
- Transaction-specific Customer Data follows Veto’s export and deletion schedule, including instructions to direct providers.
Changes and questions
Veto will update this page when the production provider set materially changes. A customer’s signed agreement controls any notice or objection right. To ask which providers apply to a specific workflow, email support@tryveto.com.