Sub-processors
Third parties that touch your data.
The processors below support the operation of Prospero Tools (Brief and Minutes). Where a processor is used by only one tool, that is noted in the Purpose column. Pack and audio content is held only by the hosting and AI processors, and only for the duration described in our security page.
| Processor | Purpose | Data category | Region | Certifications |
|---|---|---|---|---|
| Lovable Cloud (database, auth, storage, hosting) | Application hosting, authenticated database, signed-URL object storage, user identity. Used by Brief and Minutes. | Workspace, user account, audit log, briefing/minutes metadata; pack and audio files for ≤ 60 minutes. | EU / UK | SOC 2 Type II (Lovable and underlying Supabase); Supabase ISO 27001 |
| Google Vertex AI (Gemini, EU) | Standing path for all AI inference in Brief and Minutes: board-pack text extraction and refinement (Brief), and board-pack fact extraction (multimodal PDF), narrative drafting, fact-mining and template conversion (Minutes). Pinned to the EU. No-training, no-retention under the Google Cloud DPA. | For Brief: redacted (tokenised) text only — names, emails, phone numbers, IBANs and NI numbers are replaced with opaque tokens locally before any call. For Minutes text calls: the same redacted-text approach. For Minutes board-pack fact extraction: the raw PDF is sent to Vertex in the EU so the model can preserve image/scan/table fidelity; it is not persisted by Google and is not used for training. | EU | SOC 1/2/3, ISO 27001 / 27017 / 27018 / 27701, HIPAA, EU GDPR |
| Speechmatics (batch speech-to-text) — UK-headquartered | Transcribes and diarises meeting audio uploaded to Minutes, in Speechmatics' EU region. The transcription job (audio and transcript) is deleted via API on completion; Speechmatics' own auto-purge applies within 7 days as a backstop. Used only when the user uploads or emails an audio file. Not used by Brief. | Meeting audio file and resulting transcript for the duration of the transcription job; transcript text is returned to our EU/UK hosting and redacted before any further AI step. | EU (Speechmatics EU region, eu1) | ISO/IEC 27001:2022, SOC 2 Type II, GDPR |
| Mailgun (transactional email, EU region) | Inbound email ingestion for pack/audio submissions and outbound delivery of briefings, draft minutes and account notifications. Used by Brief and Minutes. | Sender/recipient email addresses, message subject and body, and attachments while in transit. | EU | SOC 2 Type II, ISO 27001 |
| Google Identity (OAuth) | Individual director sign-in via Google account, when chosen by the user. Applies to all Prospero Tools. | Email address, name, Google account identifier. | Global | SOC 1/2/3, ISO 27001 / 27017 / 27018 |
| Apple (Sign in with Apple) | Individual director sign-in via Apple ID, when chosen by the user. Applies to all Prospero Tools. | Email address (or an Apple-generated @privaterelay.appleid.com alias if the user chooses to hide their email), name if shared, Apple account identifier. | Global (Apple-managed) | ISO 27001 / 27017 / 27018, SOC 2 Type II |
Certifications listed are held by the named sub-processor, not by Prospero. We can share each provider's trust-page link on request. Prospero itself is preparing for SOC 2 readiness; see the Security page for current status.
We notify corporate workspaces in advance of material changes to this list under the data processing agreement. Last updated: 14 July 2026.
Download our Data Processing Agreement template (Markdown, Jersey law)