Vendor List
Last updated: October 2026
Trove uses the following third-party service providers (vendors) that process data on our behalf as part of providing the Trove service. We list every one here. Most offer standard data processing terms; the DPA Availability column shows each vendor's status.
The table below lists every vendor that touches customer data, the purpose they serve, the categories of data they process, where that data is stored, and the compliance frameworks each vendor attests to. If you need a copy of a specific Data Processing Agreement, contact us at the email address below.
| Vendor | Purpose | Data Processed | Location | Compliance | DPA Availability |
|---|---|---|---|---|---|
| Railway | Application hosting, database and logs | All application data | EU (Amsterdam, Netherlands); US company | SOC2 Type II | Signed |
| Tigris Data | File storage behind Railway Buckets | Uploaded documents, covers and attachments | EU (Amsterdam, Netherlands); US company | Vendor terms | Via Railway |
| Cloudflare | DNS, reverse proxy, CDN and TLS for all traffic; email routing | IP addresses and request and response content in transit; email addresses (routing) | Global | SOC2 Type II, ISO 27001 | Available |
| Clerk | Sign-in & user management | Email, name, profile image, sign-in metadata (such as IP address and device) | US | SOC2 Type II | Available |
| Polar | Payments (merchant of record) | Email, subscription status, payment data (via their payment processor) | See Polar's terms | GDPR self-certified* | Available |
| Resend | Email delivery | Email address, email content, delivery events, do-not-send list | US | SOC2 Type II | Available |
| PostHog (EU) | Product analytics, session recordings, error reports | Anonymous cookieless counts of visits and product events (with browser and device type) before you answer the cookie banner; usage events, device info and session recordings after you accept; error reports; CLI install linking | EU (Frankfurt) | SOC2 Type II | Signed |
| Google Analytics | Website analytics (only after you accept) | Page views, device info, IP address, and a cookie identifier | US | Vendor terms | Vendor terms |
| Linear | Support request tracking | Your email, message and page address | US | Vendor terms | Available |
| Slack | Internal team alerts about signups, billing and support requests, and a daily job heartbeat | Signups and new customers: your email and nameBilling events: plan, amount, billing email and subscription IDSupport requests: reporter email, request type and subject, and a short message preview | US | Vendor terms | Available |
| Anthropic | Staff tools: reviewing marketplace submissions, analysing book-gap reports, and AI-assisted engineering and support work | Books submitted to the marketplace, with the seller's name and email; topics from book-gap reports (no reporter identity); account and library records staff look up during engineering and support work | US | Consumer terms (Claude Max, model training off) | None yet (moving to Claude Team) |
*GDPR compliance is self-reported by the vendor and has not been independently verified.
AI assistants you choose to connect, such as ChatGPT or Claude, are not our vendors. You authorize them yourself, and their own terms apply. Anthropic is listed above only for our staff tools. Our servers never send your documents or your agent's questions to any AI model provider.
Where a vendor offers standard data processing terms, those terms govern its processing; the table shows each vendor's DPA status. For details on specific DPA arrangements, contact privacy@heytrove.ai.
Changes to Vendors
We update this page before we start using a new vendor. To be told about changes, email privacy@heytrove.ai.
Questions
If you have questions about our vendors, contact us at privacy@heytrove.ai.