Every outside service that can receive your data.
22 outside services can receive client data. For each one: what it receives, when, where it runs and the certifications it publishes.
| Service | What it receives | When | Where it runs | SOC 2 Type II | ISO 27001 | ISO 42001 | Their own page |
|---|---|---|---|---|---|---|---|
| Vercel | All app traffic. It runs the app. | Always | United StatesWashington, D.C. | Yes | Yes | Not stated | Their page, Vercel (opens in a new tab) |
| Supabase (on AWS) | Each client's database and files, and the shared sign-in database | Always | Canada or USEach client database in Canada (Montreal) or the US East region, set per client, and we tell you before you sign. The sign-in database is in Canada. | Yes | Yes | Not stated | Their page, Supabase (on AWS) (opens in a new tab) |
| Railway | Runs the agent worker, pipelines, a browser and code sandboxes. Each run's task and the working state it needs pass through it. | Always | Not checked yet | Yes | Not stated | Not stated | Their page, Railway (opens in a new tab) |
| OpenRouter | Every model request: the request wording and the context an agent needs, including documents it was pointed at | Each agent or Brain request | United States | Yes | Not stated | Not stated | Their page, OpenRouter (opens in a new tab) |
| Anthropic | Model requests, through OpenRouter, and directly as a fallback where a key is set | Default models | United States | Yes | Yes | Yes | Their page, Anthropic (opens in a new tab) |
| Amazon Web Services (Bedrock) | Model requests for Claude, when OpenRouter serves Claude on Amazon Bedrock | Default models | Not checked yet | Yes | Yes | Yes | Their page, Amazon Web Services (Bedrock) (opens in a new tab) |
| Model requests to Gemini, through AI Studio or Vertex AI | When the standard tier falls back | Not checked yet | Partly1 | Partly1 | Partly1 | Their page, Google (opens in a new tab) | |
| OpenAI | Model requests on fallback, and search embeddings. Embeddings go to OpenAI directly when OpenRouter refuses them. | Fallback, and document indexing | United States | Yes | Yes | Unconfirmed2 | Their page, OpenAI (opens in a new tab) |
| Microsoft Azure | Model requests on fallback, when OpenRouter serves an OpenAI model on Azure | Fallback | Not checked yet | Yes | Unconfirmed3 | Yes | Their page, Microsoft Azure (opens in a new tab) |
| ElevenLabs (through OpenRouter) | The text of replies read aloud | When someone has a reply read aloud | Not checked yet | Yes | Yes | Yes | Their page, ElevenLabs (through OpenRouter) (opens in a new tab) |
| Composio | App connections: each person's app sign-ins and pasted keys, and what each action needs | When an agent uses a connected app | Not checked yet | Yes | Yes | Not stated | Their page, Composio (opens in a new tab) |
| Resend | Recipients and contents of emails sent and received | Every email | Not checked yet | Yes | Not stated | Not stated | Their page, Resend (opens in a new tab) |
| Slack | Message text, channel and sender name | When an agent or alert posts | Not checked yet | Yes | Yes | Partly4 | Their page, Slack (opens in a new tab) |
| Twilio | Phone number and message text | SMS, if used | Not checked yet | Yes | Yes | Not stated | Their page, Twilio (opens in a new tab) |
| Vapi | Phone numbers and the voice agent's instructions | Voice calls, if used | Not checked yet | Yes | Not stated | Not stated | Their page, Vapi (opens in a new tab) |
| Cal.com | Name, email and time slot | Bookings, if used | Not checked yet | Yes | Unconfirmed5 | Not stated | Their page, Cal.com (opens in a new tab) |
| Stripe | Billing contact and invoice details | Invoices and payments | Not checked yet | Yes | Not stated | Not stated | Their page, Stripe (opens in a new tab) |
| Brave Search (or a self-hosted SearXNG) | Search terms an agent chose | Web search | Not checked yet | Yes | Not stated | Not stated | Their page, Brave Search (or a self-hosted SearXNG) (opens in a new tab) |
| Cohere | Content for search ranking and picture indexing | Only where a key is set | Not checked yet | Yes | Yes | Yes | Their page, Cohere (opens in a new tab) |
| Voyage AI | Content for search ranking and picture indexing | Only where a key is set | Not checked yet | Unconfirmed6 | Unconfirmed6 | Unconfirmed6 | Their page, Voyage AI (opens in a new tab) |
| GitHub | Code in Advizr's repositories, app builder repositories and an optional nightly copy of coworker settings | Always for code, otherwise when turned on | United States | Yes | Yes | Partly7 | Their page, GitHub (opens in a new tab) |
| Gravatar | A one-way hash of an email address | Avatars | United States | Not stated | Not stated | Not stated | Their page, Gravatar (opens in a new tab) |
- 1Google. Google's certificates name Vertex AI. Its lists do not name the Gemini API in AI Studio, which can also serve these requests.
- 2OpenAI. OpenAI says it maintains an ISO 42001 management system. We found no certificate on its public pages.
- 3Microsoft Azure. Azure holds ISO 27001. The list of services it covers sits in Microsoft's sign-in portal, so we could not confirm the model service is on it.
- 4Slack. Slack's ISO 42001 certificate covers Slack AI, not the messaging we use.
- 5Cal.com. Cal.com says it has achieved ISO 27001 and meets it. Its pages name no certificate or auditor, and we could not open one.
- 6Voyage AI. Voyage AI links its reports from a portal we could not read, and names no report type or certificate on its own pages.
- 7GitHub. GitHub's ISO 42001 certificate covers Copilot, not the code hosting we use.
- Services that receive no client data are left out: web pages agents open, market and filing data (Stooq, Frankfurter, SEC EDGAR), news feeds and push services.
- The catalogue also offers models from xAI, DeepSeek, Moonshot, Qwen, Z.ai and Nous. They are not used unless a coworker is pinned to one, and then the serving company is whoever OpenRouter picks, unless your admin sets a server policy. Custom systems can add more services.
Change log
Every change to this list, newest first. It starts with the list as it stands today.
Certifications, regions and a page of its own
The list moves to its own page. Each service shows the certifications it publishes, read from its own pages on 19 October 2026, and where it runs wherever we have checked. OpenAI and Microsoft Azure, and Cohere and Voyage AI, are now separate rows.
From 7 services to 20
A check of the platform code against this list found more services that receive client data: Amazon Web Services, ElevenLabs, Composio, Resend, Slack, Twilio, Vapi, Cal.com, Stripe, Brave Search, Cohere and Voyage AI, GitHub and Gravatar. Each is listed with what it receives and when.
Questions about a service, or a service that is not here? Write to info@advizr.ca.
Run your whole company on AI.
Tell us how your business runs. If we're not the right fit, we'll say so on the call.
Your custom strategy and systems, delivered in under a month. Or we work for free until they are.
The AI operating layer for enterprises.