LEGAL AND TRUST
Where your data goes
Version 1 · updated 2026-10-06
Written in plain language and updated as the service grows. Questions: [email protected]
The services that handle data on Provetale's behalf, what each one receives, and whether it is in use today. A service marked planned is not running yet and has received nothing.
| Service | Purpose | What it receives | Status | Region |
|---|---|---|---|---|
| Neon | Database | Account details, dataset metadata, analysis results, evidence, reports, feedback, usage counters and audit events. | In use | Singapore |
| Cloudflare R2 | Private file storage | The files you upload, their prepared copies and exported PDF, Word and PowerPoint files, in private, per-workspace storage. Files are reachable only through links that expire within minutes. | In use | Cloudflare's network (location chosen automatically) |
| DigitalOcean | Hosting the application | The application runs here and processes requests; it holds data only transiently. | In use | Singapore |
| Cloudflare | Website delivery, protection and email forwarding | Web requests to provetale.com (including IP addresses) pass through Cloudflare, and messages to our support address are forwarded by it. It does not receive your uploaded files. | In use | Cloudflare's global network |
| Resend | Transactional email | Your email address and the text of the message (for example a sign-in or billing notice). | In use | Provider's |
| Mistral AI | Writes the report's wording | Structured evidence the analysis computed (figures, column names, group names, your focus questions). Not your uploaded file or its rows. | In use | European Union (as stated by the provider) |
| Inngest | Runs background jobs | Job events carrying identifiers only (workspace, dataset, report, export ids). No file content or report text. | In use | Provider's cloud |
| Have I Been Pwned (Pwned Passwords) | Checks that a NEW password has not appeared in a known data breach | Only the first five characters of a one-way hash of the password you are choosing, sent from our server. Never the password, your email address or anything that identifies you; the match is made on our side. If the service is unavailable the check is skipped. | In use | Provider's |
| Google and GitHub | Sign-in, only if you choose it | Your name, email address and profile picture, which you allow them to share when you sign in with them. | In use | Provider's |
| Paddle | Payments (merchant of record) | Billing details you give Paddle, and the plan you chose. Provetale never sees card numbers. Not running yet: paid plans have not opened. | Planned | Provider's |
What never leaves Provetale
- Your uploaded file and its rows are not sent to the AI service.
- No advertising or tracking service receives anything.
- Our own product analytics (the steps a workspace has reached) stay in Provetale's database and hold no content.