← Privacy Centre
TRUST
Companies that help provide VisaOS
The register of every company involved in running VisaOS. It is a deliberately short list, and where we have not published a provider we say so rather than leave the entry out.
Some of these providers process information outside the European Economic Area, which requires a transfer mechanism recognised under EU data protection law. We have not published the mechanism in force for each one, and we would rather name it here once it is confirmed against the signed agreement than invent one. When this register changes we change the date above it rather than update it silently.
Anthropic
NAMED- PURPOSE
- AI-assisted guidance and narrative generation — Claude models via the Anthropic commercial API.
- INFORMATION INVOLVED
- Your application answers and the content of documents filed in the application being worked on. Not credentials, not payment details.
Stripe
NAMED- PURPOSE
- Payment processing at Export.
- INFORMATION INVOLVED
- Payment and billing details, which you provide to Stripe directly. VisaOS receives only a record that payment succeeded.
PayPal
NAMED- PURPOSE
- Payment processing at Export, as an alternative to Stripe.
- INFORMATION INVOLVED
- Payment and account details, provided to PayPal directly.
Supabase
NAMED- PURPOSE
- Database and private document storage — holding your application, your answers and the documents you file.
- INFORMATION INVOLVED
- All application content, including passport, financial and address evidence.
- PROTECTION
- Documents are held in a private storage bucket and encrypted at rest with AES-256 by Supabase. No document is publicly readable. See [Security](/security).
- CERTIFICATION
- Supabase holds SOC 2 and ISO 27001 certification. The certification is the provider’s, not VisaOS’s.
- PURPOSE
- Website analytics — Google Analytics 4, measuring how the public pages are used so we can improve them. It runs on the public website only, never inside your application.
- INFORMATION INVOLVED
- How the site was used: pages viewed, buttons pressed and where they sit, guide sections opened, and campaign labels from the link you arrived on, together with the technical information a web request carries such as IP address and browser. Never your name, your email address, your application answers, your financial figures, your documents or their file names, or any account identifier.
- WHEN IT RUNS
- Only after you switch the analytics category on. Until then the Google script is not requested, so nothing is sent and no Google storage is set. Switching it off again stops collection. See the [Cookie Notice](/cookies).
Vercel
NAMED- PURPOSE
- Application and website hosting, and TLS termination — running the VisaOS application and delivering the pages you are reading now.
- INFORMATION INVOLVED
- Application and website request traffic, and the technical and security logs that come with it, such as IP address and browser information.
- CERTIFICATION
- Vercel holds SOC 2 and ISO 27001 certification. The certification is the provider’s, not VisaOS’s.
Authentication provider
NOT YET NAMED- PURPOSE
- Account sign-in and session security.
- INFORMATION INVOLVED
- Email address, credential material and sign-in metadata.
- WHY IT IS NOT NAMED
- We have not published this provider. We will name it here rather than describe it in the abstract.
Email provider
NOT YET NAMED- PURPOSE
- Sending service email — sign-in, notifications and deletion warnings.
- INFORMATION INVOLVED
- Email address and message content.
- WHY IT IS NOT NAMED
- We have not published this provider.
Support provider
NOT YET NAMED- PURPOSE
- Handling and tracking your messages to us.
- INFORMATION INVOLVED
- Your correspondence, and whatever you choose to include in it.
- WHY IT IS NOT NAMED
- We have not published this provider.