Oriora — Sub-processors
Last updated: 2026-05-26 Effective: 2026-05-26
This page lists the sub-processors Oriora engages when providing its services. The Oriora Data Processing Addendum governs the terms under which these sub-processors may be changed and the mechanism for customer objections.
AI vendors — independent third parties, not Oriora sub-processors
The AI providers whose models process your prompts are listed at orioralabs.com/pricing/models. In every case these providers are independent third parties acting under their own terms — they are not Oriora's sub-processors, and Oriora does not control or direct how they handle your content. For BYOK, you use your own vendor credentials and hold a direct relationship with the provider; Oriora is an orchestration layer only. For Managed AI, Oriora transmits your content to a provider on your behalf to fulfil your request; the provider still acts independently under its own terms. Oriora cannot guarantee how any AI provider handles content once it is transmitted; some providers may retain inputs and outputs, or use them to operate, improve, or train their models, under their own terms. By using an AI feature you consent to this transmission.
Infrastructure sub-processors
The following entities process personal data on Oriora's behalf as part of the infrastructure required to deliver the service.
| Vendor | Location | Purpose |
|---|---|---|
| Supabase, Inc. | EU / US* | Database and authentication infrastructure. Stores account data, usage records, and application configuration. |
| Railway Corp. | US | Server runtime hosting. Processes all API requests including prompt content transmitted through Oriora's server. |
| Vercel, Inc. | US / Global edge | Landing page hosting (standby; not currently the primary host). Does not process prompt content or account transaction data. |
| Cloudflare, Inc. | US / Global edge | DNS resolution, CDN, email routing (inbound), edge WAF. Transient data only; does not persist personal data beyond standard log retention. |
| Resend, Inc. | US | Transactional email delivery (account confirmations, billing notices, system alerts). |
*Supabase project region affects where account and application data is stored. Oriora's current project region is documented in the internal connection registry. EU customers should contact support to confirm data-residency configuration.
Payment processing
Creem OÜ (Estonia) processes payment data as Merchant of Record and independent data controller for payments processed through Creem. Where you pay through Apple's in-app purchase, the applicable Apple entity for your region (identified in Apple's terms and on your receipt) processes that payment data as an independent data controller under Apple's terms. Neither is an Oriora sub-processor.
Notice of changes
Oriora will provide advance notice of any addition or replacement of sub-processors via the mechanism specified in the Oriora Data Processing Addendum. The notice period and objection process are governed by the DPA; the DPA notice period is shorter than 30 days because Oriora cannot bind its upstream infrastructure vendors to longer windows.
To raise a question or objection regarding sub-processors, contact: info@orioralabs.com