Subprocessors

Each entry names the vendor, what we use it for, and roughly what kind of data passes through it. A vendor appears here because Vorx's own infrastructure calls it directly — we did not include tools that only support our internal operations (accounting, recruiting, and the like) and never touch Platform data.

Some vendors act as an intermediary in front of other providers. Where that's true, we say so explicitly rather than listing only the name closest to us.

Vorx does not currently hold direct accounts with individual AI model providers. Model calls made while generating or editing your app — including the text of your prompts and the code/content generated in response — are routed through OpenRouter, which in turn calls the specific model provider configured for that step (at the time of writing, primarily Anthropic and Google). OpenRouter's own downstream model providers should be understood as further subprocessors of OpenRouter for this purpose, not of Vorx directly, but we name this chain here because it is where your prompt content actually goes.

We are evaluating a direct integration with Anthropic for some model calls. Anthropic is not in use as a direct subprocessor today; we name it now so that, if that evaluation ships, the same processing described above may also flow to Anthropic directly without changing what this page has already told you.

• Cloudflare — DNS, CDN, and edge delivery for vorx.com and published customer sites/apps; sees request traffic to those domains.
• Fly.io — hosts live preview instances of in-progress builds while you're working on them.
• Google Cloud Platform — build infrastructure (Cloud Run, Cloud Build) and file storage for uploaded assets (Google Cloud Storage).

If you opt an app into a cloud backend, its database and related backend services are provisioned on Supabase infrastructure, under a project Vorx manages on your behalf. Data your app's own users create through it — the app's own end-user data, not just your Vorx account data — is stored there.

Stripe processes subscription billing and payment card details. Vorx does not store full card numbers; Stripe handles that as an independent PCI-DSS compliant processor.

WorkOS brokers enterprise single sign-on (SSO/SAML) and directory sync for organizations that use it, and handles the identity data that flow requires (email, name, and whatever attributes your identity provider sends).

Postmark delivers account, billing, and notification emails on our behalf, which necessarily includes your email address and the content of those messages.

• PostHog — product analytics and session replay inside the Vorx app itself, so we can see where builders get stuck. Runs only in production, on PostHog's EU Cloud (data is processed in the EU). It can capture in-app interactions and screen recordings of your Vorx sessions — of the Vorx interface, not of your published app's end users.
• Google Analytics — page analytics on the vorx.com marketing site only. Analytics storage is off by default and only enabled if a visitor grants consent; ad storage and ad personalization stay denied either way. It does not run inside the app.

We'll update the date at the top of this page when we add, remove, or change the role of a subprocessor. For material additions, contact legal@vorx.com to ask about advance-notice arrangements for your account.