Last updated: April 9, 2026
Subprocessors (marketing site)
Purpose
Orvipa relies on specialized vendors (“subprocessors”) to host, deliver, measure, and support this public marketing website. This page lists categories of subprocessors typically involved, the services they provide, and the categories of data they may process on our behalf. Subprocessors process data only according to our instructions and written agreements, subject to applicable law.
Product subprocessors — the Orvipa payroll application may use additional or different infrastructure (databases, queues, email delivery, identity, etc.). Customers should rely on the subprocessors annex or list provided in their order form or data processing agreement for production services, not solely on this marketing-site list.
Due diligence and contracts
We evaluate subprocessors for security and privacy practices appropriate to the data they handle. Contracts include confidentiality obligations, permitted use restrictions, and assistance provisions for data subject requests and incidents where required by law.
Marketing-site subprocessors
| Subprocessor | Service | Categories of data | Typical location / notes |
|---|---|---|---|
| Vercel Inc. (or equivalent host) | Hosting, CDN, serverless functions, TLS | IP addresses, HTTP logs, request headers, cached static assets | United States and global edge; data residency per project settings |
| Plausible Insights (optional) | Privacy-oriented analytics | Aggregated page views, events, referrer, country-level region | Not in use on this website at present |
| Google LLC (Analytics) | Google Analytics 4 | Client IDs, device data, IP (per GA settings), events | Not in use on this website at present |
| Microsoft Corporation (Clarity) | Session replay and heatmaps | DOM interactions, coarse location, session recordings | Not in use on this website at present |
| Vercel (Analytics / Speed Insights) | Web analytics and performance metrics | Page views, Web Vitals, route data | When we use these products from our host; loads only after you opt in to analytics on this site |
| DNS and certificate authorities | Domain resolution and public key infrastructure | Query metadata (provider-dependent) | Global; depends on registrar and DNS host |
| Font and asset CDNs (if used) | Delivery of web fonts and static files | IP address, user agent (standard HTTP) | Typically Google Fonts or self-hosted, depending on how the Site is set up |
| Corporate email provider | Inbound/outbound mail for @ contact addresses | Message bodies, headers, attachments, metadata | Depends on the provider we use for our business email (for example a cloud email service) |
International transfers
Subprocessors may process data in countries outside Canada. Where personal information is transferred from the EEA, UK, or Switzerland, we implement appropriate safeguards such as standard contractual clauses or equivalent mechanisms as required by law and described in customer agreements.
Changes to subprocessors
We may add or replace subprocessors to improve security, performance, or compliance. For the marketing Site, material changes will be reflected on this page with an updated “Last updated” date. For product processing, customer agreements typically require advance notice or an opportunity to object for certain categories of change.
Contact
Questions about this list: hello@orvipa.com.