INGESTIA uses the vendors below to operate the Platform. When they process Customer Data, these vendors may act as sub-processors. For their own billing or account data, some may act as independent controllers, in accordance with their terms and the law.
| Vendor | Service and purpose | Main location | Data involved |
|---|---|---|---|
| Google Cloud | BigQuery, Cloud Storage and Cloud Run for datalake, landing and processing | São Paulo, Brazil | Business data, files, schemas, queries and technical logs |
| Vercel | Application hosting and delivery | United States | Request metadata, account, usage and logs |
| Neon | Metadata PostgreSQL | United States | Account, organization, billing, pipelines, configuration and encrypted credentials |
| Asaas | Billing and payment | Brazil | Identification, billing, Pix and card, according to the provider's flow |
| Anthropic | Artificial intelligence for text-to-SQL | United States | Schemas, metadata and text of queries/prompts |
| Resend | Transactional e-mail | United States | Name, e-mail and content of the operational message |
| Google (OAuth) | Social login ("Sign in with Google"). Authentication is our own (Auth.js); the identity is stored at Neon | United States | Name, e-mail and Google account identifier |
Safeguards
- Business data in BigQuery/GCS and heavy extraction in Cloud Run are configured in the São Paulo region.
- International transfers will be covered by a mechanism accepted under the Brazilian General Data Protection Law (LGPD) and Resolution CD/ANPD No. 19/2024, as applicable.
- INGESTIA requires contractual commitments on confidentiality, security, purpose limitation and cooperation compatible with the service.
- Source credentials stored at Neon are encrypted with AES-256-GCM before storage.
- Data sent to Anthropic must be limited to what is necessary to generate queries and must not include row content without a disclosed and authorized need.
Changes
New material subprocessors will be announced by e-mail, in the dashboard or on this page at least 15 days in advance, except for an urgent replacement necessary for security or continuity. The customer may submit a reasoned objection through privacidade@ingestia.io, in accordance with the DPA.