Service providers and subprocessors

Clova uses specialist providers to run its services. This page explains their roles and separates public website services from app and connected-banking services.

A service provider supplies a service to Clova. A subprocessor processes information on behalf of another organisation in a processing chain. Under the Consumer Data Right (CDR), an outsourced service provider (OSP) has specific obligations under a CDR outsourcing arrangement. These descriptions are not interchangeable: listing a provider does not authorise it to receive CDR data.

The table below explains current website services and planned app services. The app and connected banking are not yet available; planned providers are subject to the required arrangements being in place before launch.

Providers by service

Provider	Purpose	Website and marketing	App and connected services
Vercel	Hosting, request processing and background jobs	Delivers pages and processes website requests, including submitted forms and technical metadata	Hosts the API and background jobs, handling authorised service requests and operational records
Neon	PostgreSQL database hosting	Stores registration profiles, research and feedback responses, access-credential hashes and delivery records	Stores account, consent and authorised financial records
Upstash	Authentication storage and rate limiting	Processes rate-limit identifiers and technical metadata to reduce abusive requests	Stores permitted authentication or session records and supports rate limiting
Cloudflare	Domain, network and security services	Processes domain and network metadata and request information where routed through its services	No separate app service listed
PostHog	Analytics	Measures visits, interactions, campaigns and heatmaps using filtered events and identifiers that may link to a registration profile; session recording is disabled	Measures filtered product use, errors and reliability; excludes financial content, CDR access or viewing events, marketing tracking, heatmaps and session recording
Resend	Email delivery and preferences	Handles contact details, email content and delivery records for registration messages, research confirmations, updates and contact-form messages	Delivers account and service emails using necessary contact and delivery information; unnecessary financial content is excluded
Fiskil	Planned CDR provider for future banking connections	Not used for website analytics, registrations or research and feedback responses	Planned only: would collect authorised banking information and share it with Clova after launch and separate consent

Locations and access

Core app hosting and database services use Sydney configurations for Vercel, Neon and Upstash. App analytics uses PostHog's EU service. These locations do not necessarily cover every backup, log or support interaction. Website analytics has its own configuration.

Cloudflare operates a global network. Email, analytics and support services may involve overseas processing. The applicable Fiskil policy and consent process identify CDR overseas disclosures where required. Contact us for information about a particular provider or service.

Provider privacy information

These notices explain each provider's own privacy practices. They do not replace Clova's obligations or establish the configuration of a particular Clova service.

Provider changes and questions

Provider changes require assessment of the purpose, information, access, location and deletion arrangements. We update this page and provide notice or obtain consent where required.

Our Privacy Policy explains your information and choices. Our CDR explanation explains connected banking and Fiskil's role. For a provider question or privacy request, email support@getclova.com or visit Contact us.