Data Processing and Vendor Schedule
Inventory of processors and infrastructure used for hosting, email, analytics, KYC storage, and market data.
- Document type
- Information policy
- Category
- Platform and data operations
- Version
- 2026-08-24
- Effective
- August 24, 2026
- Issued by
- Ohana Capital AG
On this page7 sections
1. Status of this document
This Data Processing and Vendor Schedule lists processors and infrastructure providers actually used (or configured) for the Ohana Capital platform and CRM. It supports privacy, security, and counsel review of data-processing agreements (DPAs).
Controller: Ohana Capital AG (see Privacy Policy).
Vendor commercial terms and DPAs must be filed internally. Public listing here does not replace signed contracts.
2. Core processing inventory
| Provider | Purpose | Categories of data (typical) | Location notes |
|---|---|---|---|
| Supabase | Auth, Postgres database, storage, server functions | Account, profile, KYC files metadata/objects, ledgers, audit | Cloud region per project config |
| Vercel | Application hosting, edge/serverless delivery, Analytics / Speed Insights (if consented) | Request logs, deployment metadata, performance metrics | Global edge network |
| Resend | Transactional and CRM email send/receive | Email addresses, message content, delivery events | Per Resend account region |
| Freshdesk (Freshworks) | Customer support tickets, knowledge base, and support communications | Contact details, ticket/support content, support metadata | Per contracted Freshworks region |
| Crisp (only when configured and consented) | Optional website customer-support chat and AI-assisted support | Chat content/attachments, authenticated email plus verification signature, session cookie, IP/device and support metadata | Per contracted Crisp workspace configuration and transfer terms |
| PostHog | Product analytics / session insights (if consented) | Usage events and session replays linked to the account (user ID, email, name); page text and form entries are recorded, while passwords, one-time codes and card fields stay masked | US project configuration in current staging |
| Upstash Redis | Rate limiting, quote cache, and one-time assistant action nonces | IP/user rate keys, cached market quotes, hashed short-lived nonces; no assistant conversation content | Per Upstash region |
| Venice AI | Private CRM assistant inference, only after governance approval and feature activation | Minimized and tokenized operator requests/tool results; operational API metadata may be processed | Provider infrastructure and subprocessors subject to DPA/SCC review |
| Financial Modeling Prep (FMP) | Market data API | Instrument symbols / quote requests (not full KYC dossiers) | Provider infrastructure |
| Browser local storage | Session / cookie preference persistence | Support-chat and analytics choices, session identifiers | User device |
Career applications may use a dedicated storage bucket for resumes. Legacy support-download buckets are not part of the public support model.
3. Subprocessor governance
Before adding a material processor that handles personal data:
- Complete vendor due diligence (security, location, subprocessors).
- Execute a DPA / SCCs or equivalent where required.
- Update this schedule and, if needed, the Privacy Policy.
- Limit access to least privilege and encrypt in transit.
4. International transfers
Where personal data is transferred outside Switzerland or the EEA, Ohana Capital relies on appropriate safeguards (for example standard contractual clauses, adequacy, or other lawful mechanisms) as documented with the relevant vendor. Exact transfer tools should be confirmed by counsel against current vendor contracts.
5. Security expectations for vendors
Vendors processing personal data are expected to provide:
- Access controls and authentication
- Encryption in transit
- Incident notification commitments
- Deletion / return assistance on contract end
- Subprocessor transparency
Platform-side controls include authenticated APIs, role-based CRM access, private document storage, and audit logging for sensitive reviews.
6. Customer rights routing
Access, deletion, and correction requests follow the Privacy Policy. Operators must not export KYC documents outside approved systems except for legal / compliance necessity.
Questions about this document?
Contact Ohana Capital AG and include the document title and version in your message.
