Sub-processors
The companies that process data on Socria’s behalf. Each sees one slice, and only what it needs to do its job.
Last updated August 2026
Who processes what
| Company | Role | Receives | Location |
|---|---|---|---|
| OpenAI, L.L.C. privacy policy | AI inference | Your messages and recent conversation history — sent to generate each reply, and separately to build your Thinking Map, memory and syntheses. | United States |
| Supabase, Inc. privacy policy | Database and storage | Everything stored: conversations, maps, drafts, grounded material, thread memory, the Thinking Journey, and subscription status. | United States |
| Clerk, Inc. privacy policy | Authentication | Your email address and sign-in credentials, and session management. | United States |
| Stripe, Inc. privacy policy | Subscription and payment processing | Billing details for Socria One. Card numbers go to Stripe directly and never reach our servers. | United States |
| Vercel, Inc. privacy policy | Application hosting | Request metadata in the ordinary course of serving the site, including IP address. | United States |
| Vercel, Inc. privacy policy | Analytics | Aggregate page views. Not tied to your conversations. | United States |
| Upstash, Inc. privacy policy | Rate limiting | A counter keyed to your account id, or to your IP address when you are not signed in. No message content. Entries expire on their own within the hour. | United States |
| Resend, Inc. privacy policy | Email delivery | Your email address and the note itself, on the few occasions Socria sends one — a welcome to Socria One, or a reminder that a map is where you left it. Never your conversations, and never a title. You can stop them from any note or under Data & Privacy. | United States |
| Serper / Tavily privacy policy | Web search, when a source is looked up | The search phrase only — not your conversation. Only when Logos looks something up for you. | United States |
Only if you connect them
Nothing below is reached until you link the account yourself, and disconnecting it in Logos deletes the stored credential.
| Company | Role | Receives |
|---|---|---|
| Google LLC privacy policy | Drive, Gmail and Calendar, if you connect them | The searches you run against your own account, and the documents you choose to pull in. |
| Notion Labs, Inc. privacy policy | Notion, if you connect it | The searches you run against your own workspace, and the pages you choose to pull in. |
A note on AI processing
Your conversations are sent to OpenAI to generate replies and to build your map. Under OpenAI’s API data-usage policy, data submitted through the API is not used to train their models by default, and inputs and outputs are retained for up to 30 days for abuse monitoring before deletion, unless a longer period is required by law. Socria uses the standard API, not a zero-retention endpoint, so that 30-day window applies to us.
Those durations are OpenAI’s published policy, not a private agreement we hold, and their terms are theirs to change. We have not signed a DPA with them or enabled Zero Data Retention. If your organisation needs either one contractually guaranteed, that is a conversation to have with us before you rely on it. Ask us at hellosocria@gmail.com.
International transfers
All of the above are United States companies, so data about you is processed in the US. If you are in the EEA, the UK or Switzerland, that is an international transfer, and these vendors rely on Standard Contractual Clauses and their own transfer frameworks. If you require a signed data processing agreement, write to us — for a product at this stage that is a conversation, not a download.
Changes
We will update this page when a sub-processor is added or replaced. Questions: hellosocria@gmail.com. See also the privacy policy and security.