Subprocessors and other providers
This list explains the providers used to deliver Fern™ and its variants and distinguishes them from website and business providers. The DPA governs Customer Data processing and changes to Subprocessors. A Customer's Order Form records any deployment-specific restriction.
1. Fern Subprocessors
| Provider | Function and data | Processing location |
|---|---|---|
| Amazon Web Services, Inc. | Environment compute, databases, document storage, local document models, encryption keys, secrets, backups, logs, monitoring and threat detection. Processes Customer Data, Outputs, Configurations and service account records. Amazon SES may deliver sign-in messages when enabled. | Standard storage and primary backups: us-east-1, United States. Second-US-region backup copies are planned, not represented as enabled. |
| Anthropic, PBC | Commercial model processing of questions, instructions, gathered public material, relevant private passages in the restricted processing step and Output drafts. | Provider infrastructure and authorized processing locations under its commercial DPA and published Subprocessor arrangements; no deployment-specific US-only restriction is promised. |
| OpenAI OpCo, LLC | Commercial API model processing of the same types of relevant content. | Provider infrastructure and authorized processing locations under its commercial DPA; not limited to the Environment's AWS region. |
| Google LLC, paid Gemini API | Commercial model processing of the same types of relevant content. Free-tier processing is not authorized for Customer work under these terms. | Google's processing infrastructure under its paid API terms; no fixed US-only processing region is promised. |
| Cloudflare, Inc. | Fern's edge connection, routing directory, sign-in front end and encrypted tunnels to Environments. Handles traffic in transit, routing/account identifiers and, when Customer authorizes a share link, its published snapshot. | Global edge network and service infrastructure. TLS terminates at the edge and traffic is re-encrypted to the Environment. |
Provider locations are not a promise that all processing occurs in the United States. Applicable provider transfer terms and the DPA govern international processing. Customer may request the provider location and transfer information relevant to its deployment from [email protected]. A narrower location restriction must be agreed and configured, not inferred from US storage.
Cloudflare's routing metadata and authorized share snapshots are outside the private Environment. That does not make the underlying document library public. A share link exposes the selected snapshot to its permitted recipients under its access settings; private-document answers are not included in that snapshot.
2. Model processing and retention
Customer work uses commercial API accounts with terms prohibiting training on Customer content. Consumer subscription accounts are not used. Varosync does not itself train or fine-tune on Customer Data, Outputs or Configurations.
| Provider | Applicable treatment |
|---|---|
| Anthropic | Commercial API confidentiality and no-training terms. Retention depends on the model, feature and approved account arrangement, including ordinary abuse-monitoring and legally required exceptions. Zero retention is used only where offered and confirmed for the relevant processing. |
| OpenAI | Commercial API no-training terms. Standard abuse-monitoring retention may be up to 30 days; application-state retention varies by feature. Approved zero-retention controls cover eligible processing, not every feature or legal exception. |
| Paid Gemini API terms prohibit use of Customer content to improve Google's products. Abuse-monitoring retention may be up to 55 days under the published usage policy, subject to its exceptions. This list makes no zero-retention representation for Google. |
Turning off response storage in a request is not proof of an account-wide zero-retention agreement. If Customer requires zero retention, the Order Form identifies the covered provider, models, features and confirmed arrangement, together with any effect on the Council. Varosync stops sending Customer Data through a route that no longer meets its agreed no-training or retention conditions and notifies Customer.
The provider references are the Anthropic API retention documentation, OpenAI API data controls, Google paid API terms and Google abuse-monitoring policy. This description was checked on 13 October 2026. Published provider terms are not evidence of a specific account approval.
3. Other business and website providers
These providers serve the purposes below. They are not approved routes for Customer's private document library. They may receive personal information and confidential commercial records relevant to their function, so “not a Fern Subprocessor” does not mean “receives no confidential information.”
| Provider | Purpose and information | Scope |
|---|---|---|
| Stripe | Planned individual subscriptions, top-ups, receipts, tax calculation and any agreed card payments; billing contacts, payment details, transaction and tax records. Stripe may act independently for fraud prevention and legal duties. | Checkout uses Stripe when individual paid plans are activated. Varosync remains responsible for tax registration and remittance. |
| Resend | Website enquiry notifications containing form information and referral details. | Website enquiries, not workspace document processing. |
| Cal.com | Booking details, name, email, time zone and preferences. | Scheduling; the enquiry's substantive description is not passed as a booking field. |
| PostHog, US cloud | Access acceptance and viewing events, and consented replay, on Varosync's own shared-material pages. | Not loaded inside the signed-in Fern workspace. Replay retention is 30 days. |
| Google Analytics | Consented website usage statistics, browser identifiers, page and referral information. | Public website, not the signed-in workspace. |
| Microsoft Clarity | Consented website interaction recordings and heatmaps; form inputs are masked and advertising sharing is disabled in the site configuration. | Public website, not the signed-in workspace. |
| Cloudflare, website services | Website hosting, enquiry and consent records, connection security and Turnstile form checks. | Separate purpose from its Fern Subprocessor role. |
Business-provider processing may occur internationally under the relevant provider terms. A signing or support provider not listed here is not silently approved to receive workspace content. The provider is identified in the actual workflow and, if appointed to process Customer Data for Varosync, added under the DPA before that processing.
4. Customer connections and public research
Customer's document-storage service, identity provider and chosen Microsoft Teams, Slack or Symphony channel operate under Customer's agreements. Fern reads only authorized locations and sends alerts to Customer's chosen channels. Customer controls recipients and connection permissions.
Public-web research sends search terms and page requests to search services and source websites. They may reveal the subject of the question. They do not carry uploaded documents or private document passages. Provider-operated search tools are subject to the enabled provider's service arrangements. The fact that Fern contacts a public source does not authorize uploading Customer's private library to it.
Varosync personnel are governed by confidentiality, access and Forward-Deployed Services obligations, not treated as unrelated recipients.
5. Changes
Varosync gives 30 days' notice to Customer's privacy contact before a new Subprocessor, a material expansion of its data or a new processing country outside the disclosed arrangement. The notice describes identity, purpose, information, location and start date.
Customer may object within 30 days on reasonable data-protection grounds. If no solution is agreed within 30 days after objection, it may terminate the affected service with a pro-rated refund of prepaid unused fees. Urgent replacements to preserve security or service may use shorter notice without removing these rights.
Removing a provider requires notice but no objection period. Changing models within an approved provider is not itself a new Subprocessor, but cannot bypass an agreed retention, location or data restriction. Business-provider changes follow the Privacy Notice unless they introduce Customer Data processing, in which case the DPA applies.
6. Version history
Version 1.0, 13 October 2026: initial contracting list. Deployment-specific elections are recorded in the Order Form. Questions and update requests: [email protected].