Skip to content
NORA
Last updated: April 19, 2026
Legal

Sub-processor List

Last updated: April 19, 2026. This page lists the third-party sub-processors that NORA Foundation engages to deliver Meridian services. We will update this page before onboarding any new sub-processor.

1. Current sub-processors

The following entities process data on behalf of NORA Foundation in connection with the Meridian workspace, archive, and attestation services. Each sub-processor is bound by a data processing agreement that imposes obligations no less protective than those in our Data Processing Agreement.

NamePurposeLocationData types
VercelApplication hosting, edge network, serverless functionsUnited StatesHTTP requests, logs, static assets, server-rendered pages
ClerkAuthentication, user management, session handlingUnited StatesEmail addresses, profile data, session tokens, auth logs
StripePayment processing, subscription billingUnited StatesPayment method details, billing address, transaction records
ResendTransactional email deliveryUnited StatesEmail addresses, email content, delivery metadata
OpenAIAI inference (cloud tier only)United StatesDocument content and queries submitted to AI features
AnthropicAI inference (cloud tier only)United StatesDocument content and queries submitted to AI features
Google CloudAI inference (cloud tier only)United StatesDocument content and queries submitted to AI features
Neon / Supabase(TBD)Database hosting, per-user PostgreSQL databasesUnited StatesAll data stored in tenant databases: documents, metadata, custody chains, attestations, user preferences

2. Subscribe to changes

Under our Data Processing Agreement, we notify customers before onboarding new sub-processors. To receive advance notification of changes to this list, send an email to legal@norafoundation.io with the subject line "Sub-processor notifications" and we will add you to our notification list.

3. Change log

No changes since initial publication.

DateChangeEffective date
No changes recorded.