Trust
Sub-processors
Last updated: 28 October 2026
These are the third parties that handle customer data on Cerno's behalf, what each one does and what data it sees. Any change to this list is made on this page.
Private tasks and the AI provider
Important: the text of a private task is sent to the AI provider (OpenAI, or Anthropic where a Claude model is used) exactly like any other task. A private task is hidden from other people in your office, including the owner, but it is still processed by the AI provider.
The list
| Provider | Purpose | Data involved | Location |
|---|---|---|---|
| Supabase | Database, sign-in (authentication) and private file storage. | Account email and profile, saved decisions, office data (staff, tasks and results, members, approvals, usage records), and files stored in your office. | See provider (the region is chosen per project). |
| Vercel | Application hosting and delivery, and cookieless website analytics (aggregate traffic). | Everything sent to the website in transit (requests and responses), request logs, and aggregate page-view analytics. | United States / global (a global edge network). |
| OpenAI | AI processing (advisors, staff tasks, meetings), speech to text for dictation, and text to speech for spoken replies. | The text of your questions, context and tasks, including the text of private tasks (a private task is hidden from other people in your office, but its text is sent to the AI provider like any other task). Short voice recordings when you dictate, and the text to be read aloud. Cerno stores no audio. | United States / global. |
| Anthropic | AI processing for the advisors and tasks that are set to use Claude models.Used when a Claude model is configured for the work. | The text of your questions, context and tasks, including the text of private tasks, sent in the same way as to OpenAI. | United States / global. |
| Resend | Sending email: invitations, review reminders and similar messages you ask for.Used only when email sending is configured; without it, invite links are copied by hand. | The recipient's email address and the content of the message. | United States / global. |
| Stripe | Payments and subscriptions.Used when payments are switched on. | Your email address, plan and billing details, entered on Stripe's own pages. Cerno never sees or stores your full card number. | United States / global. |
| Cloudflare (Turnstile) | A bot check on the waitlist form.Used only when the check is configured. | A challenge token, your IP address and browser signals, from visitors to the waitlist form. | United States / global. |
| Google (Google Analytics) | Website analytics.Used only when analytics is switched on, and only after you accept analytics cookies in the cookie banner. | Page views and device and browser information, from visitors who accept analytics cookies. | United States / global. |
Locations are given as the provider operates them. “United States / global” means the provider runs a global service with United States operations; where a provider lets the region be chosen, we say so and do not claim a region here. Transfers outside the UK are covered by the safeguards described in our privacy policy.
Changes
This page is updated before a new sub-processor starts handling customer data. The date at the top is the last time the list changed. For how we protect data in general, see our security page.