Ormeval provides decision-support intelligence derived from public sources. It is not investment, medical, legal or regulatory advice, and states nothing about the value of any security. Forward figures are deterministic model estimates, not guidance.
Legal
Last updated: 9 September 2026
These are the third-party services Ormeval relies on to run the platform, and exactly what each one receives. It is published rather than kept “available on request” so a security or procurement review can read it without waiting on us. It forms part of our Data Processing Agreement.
2 of 6 are currently switched on. The rest are integrated in the codebase but inert until their credentials are configured, they receive nothing in the meantime. We list them anyway, because telling you afterwards is not notice.
Supabase
ActiveApplication database, authentication and file storage
Receives: Account email, display name and profile; saved cockpit configuration and follows; team membership, shared books and annotations; community posts, comments and messages. This is the only sub-processor that holds account data at rest.
Vercel
ActiveApplication hosting, edge delivery and scheduled jobs
Receives: Every request to the site transits Vercel infrastructure: IP address, request metadata and standard server logs. Vercel is our US-based host, terminates each connection and runs the scheduled ingest, but does not hold account data at rest.
Stripe
Not enabledSubscription billing
Receives: Billing email and subscription state. Card details are entered directly with Stripe and never reach Ormeval's servers.
Anthropic
Not enabledThe grounded 'Ask Ormeval' assistant
Receives: Only the question typed into the assistant, the passages retrieved from Ormeval's own indexed content to answer it, and up to six prior turns of that conversation. No account record, no cockpit configuration and no team data is sent. The assistant is not trained on your inputs.
Resend
Not enabledTransactional and digest email
Receives: Recipient email address and the message content of alerts and digests you have opted into.
PostHog
Not enabledProduct analytics
Receives: Page views and feature-usage events. Used to see which parts of the product are worth building on.
The pharmaceutical content itself, assets, indications, trials, forecasts, contains no personal data, so it is not covered here. Our data sources and how figures are derived are documented separately on the methodology page.
We will update this page before a new sub-processor begins processing personal data, and teams on a signed DPA receive notice of material changes. To be told when this register changes, or to raise an objection, email hello@ormeval.com.
Each sub-processor is engaged under its own data-protection terms, which include transfer clauses. The transfer mechanism for our own entity, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, is being put in place with counsel and is not yet executed, as stated in the DPA. Hosting regions and per-vendor certifications are confirmed on request for enterprise agreements rather than asserted here, so that what this page states is only ever what we can evidence.