Trust

Subprocessors

DRAFT / NOT COUNSEL APPROVED · REN-LEGAL-DRAFT-2026-08-18-E1

A subprocessor is a third-party service that processes Renvest customer data on our behalf. This page mirrors the authoritative list maintained in source control and is updated whenever a subprocessor changes. Contact security@renvest.app with questions.

Active subprocessors

Each row lists the purpose, the data categories Renvest may share, the processing region, and a direct link to that vendor's Data Processing Agreement and privacy notice.

Supabase

United States

Primary database, authentication, and file storage.

All product data: accounts, balances, transactions, household membership, encrypted provider tokens, receipts, assistant conversations.

DPAPrivacy

Vercel

United States

Web application hosting, CDN, edge runtime, and build logs.

Application logs, request metadata, and build artifacts. No persisted user data outside transient request memory.

DPAPrivacy

Plaid

United States

Bank account aggregation: balances, transactions, and identity-light account metadata.

An opaque client user ID, the consumer-bank credentials the user enters into Plaid Link (held by Plaid, never by Renvest), and the resulting account and transaction metadata Renvest reads back through Plaid.

DPAEnd-user privacy

Stripe

United States

Subscription billing, checkout, and payment processing.

Stripe customer ID, subscription state, invoice metadata, plan key, and household linkage. Card data is held by Stripe; Renvest never receives card numbers or security codes.

DPAPrivacy

OpenAI

United States

LLM inference for typed household assistant questions, receipt extraction, item and transaction categorization, and liability statement extraction. Voice/realtime intake is deferred from the current public product.

Typed assistant: minimized household snapshots and redacted user prompts. Voice/realtime: if explicitly enabled in a future or separately configured environment, live microphone audio plus a minimized household snapshot may be processed during the active session. Receipt extraction: receipt image or PDF bytes and extracted receipt text context. Receipt item categorization: merchant and line-item candidates. Transaction categorization: merchant, description, amount, direction, posted date, and allowed category names. Liability statement extraction: uploaded statement image or PDF bytes plus sanitized debt context. Training on Renvest API traffic is not permitted; AI output is suggestive and reviewable, not financial truth.

DPAEnterprise privacy

Conditional and feature-flagged

These integrations are present in the codebase, but this source page does not assert that any one is enabled or disabled in the current production environment. Confirming or changing a production activation requires environment evidence and a documentation update at the same time.

  • MX. Alternate bank aggregator. Code path present; disabled by feature flag in production.
  • Finicity. Alternate bank aggregator. Code path present; disabled by feature flag in production.
  • Sentry. Application performance monitoring. SDK is wired; inactive until production Sentry DSNs are configured. Events are scrubbed before send.
  • Quiltt (financial API). Conditional financial-data aggregation integration at quiltt.io. Code and configuration paths exist; it remains feature-flagged and production activation is not proved.PrivacyTerms

What we never share

  • Renvest does not sell household financial data.
  • Renvest does not authorize any subprocessor to use customer data for advertising or for training models that benefit third parties.
  • Card numbers and security codes are entered directly into Stripe Checkout; Renvest never receives them.
  • Bank credentials and multi-factor codes are entered directly into Plaid Link; Renvest never receives them.
  • The Supabase service-role key is server-only and is enforced by an import boundary in source control.

Customer notice on changes

When Renvest adds, replaces, or removes a subprocessor that processes household financial data, this page is updated to reflect the change. The authoritative source lives in source control and the public commit log is the change history.