Subprocessors
These are the third parties that process your data on our behalf. We vet each provider for security and compliance before onboarding, and we'll notify you before adding new ones. To get notified of changes, email security@novana.io with the subject "Subscribe to New Subprocessors."
Infrastructure
These providers host and run Novana. Your uploaded files, evidence data, and AI-generated analysis flow through this infrastructure. All Customer Content is stored and processed primarily in Japan.
| Subprocessor | Purpose | Location |
|---|---|---|
| Google Cloud Platform | Primary hosting, file storage, compute, database, and secrets management | Japan |
| Vercel | Application hosting and serverless functions | Japan |
Platform
When you upload evidence, these services analyze and process it. Your content is scrubbed for PII before reaching AI providers, processed in volatile memory during a single request, and never retained afterward.
| Subprocessor | Purpose | Location |
|---|---|---|
| OpenAI | LLM for evidence analysis, requirements matching, and content generation. Volatile memory only. | USA |
| Amazon Web Services (Bedrock) | LLM (Claude models) for evidence analysis and content generation. Volatile memory only — Anthropic never receives or stores your data. | USA |
| Google AI | LLM for evidence analysis and content generation. Volatile memory only. | Global |
| Inngest | Background job orchestration. Data processed in transit, not retained beyond job completion. | USA |
| Google Drive | File import integration. Read-only access; files transfer directly to Japan-based infrastructure. | Global |
Supporting Services
Authentication and analytics. These services support Novana's operation but never see or store your evidence, files, or student data.
Last updated: February 18, 2026
Questions? Concerns? Ask us anything.
Whether it's a security question, a compliance requirement, or something that doesn't fit neatly into a category — we're here to help. No question is too small.
security@novana.io