Last updated: October 2026
These third parties process personal data for Verdikx. Providers in the second table are used only when a merchant connects them, or when the feature is configured for the deployment. Payment processors are connected at the merchant’s choice; Verdikx receives their dispute records and sends only the evidence the merchant approves. SEON is used only if a merchant enables it, with the merchant’s own SEON key, and early-access integrations process data only when a merchant connects them.
Core infrastructure
| Provider | Purpose | Data categories | When used |
|---|---|---|---|
| Supabase | Database, authentication and private file storage | Merchant accounts and sign-in records; store, order, customer, dispute and evidence records; uploaded files and evidence packets; talent community sign-ups and résumés | Always |
| Vercel | Application hosting, serverless functions and scheduled jobs | All data the application processes while handling a request; request logs (including IP address and user agent) | Always |
| Shopify | The platform the app runs on: installation, sign-in inside Shopify admin and subscription billing | Store, order, customer, fulfillment, policy and dispute data you authorize; subscription status | Always (the app installs on Shopify) |
| OpenAI | AI-assisted dispute drafts, the contradiction finder, reading forwarded dispute notices, risk explanations for flagged or held orders and customer profiles, and the Ask Verdikx help assistant | A limited, de-identified subset of order evidence; for risk explanations, screening results with a masked email, the IP network prefix with its country, its state or region when the optional location lookup gives one (never its city) and its network, and history counts; redacted customer-message excerpts; the subject, sender and text of dispute emails you forward, with email and IP addresses, IBANs and card-like numbers masked first and common formats of phone numbers, street addresses and buyer names masked too (pattern-based, so an unusually written detail can still get through); questions asked in Ask Verdikx with non-sensitive account facts. No uploaded files. Response storage off; not used for training | When AI features are enabled for the deployment |
| Resend | Sending notification emails; receiving forwarded dispute emails when it is the configured inbound provider | Recipient email address and notification text; for inbound mail, the forwarded email and its attachments | When email is configured for the deployment |
| Sentry | Error monitoring | Technical error details with internal account identifiers; emails, tokens, secrets, IP addresses and query strings are masked before sending | When error monitoring is configured |
| MaxMind | IP intelligence for order screening (country and network of a checkout IP address) | None for the GeoLite2 databases, which we download and query on our own servers. If the paid GeoIP2 Insights service is enabled, the checkout IP address only | When a MaxMind licence key is configured; Insights only if enabled |
| Stripe (Verdikx billing) | Card billing for Verdikx subscriptions of workspaces not billed through Shopify (hosted Checkout and billing portal), and invoices for custom agreements with workspaces not on Shopify | Account email, internal account id, plan, billing cycle and subscription status; for Enterprise invoices, the billing contact's email, company name and invoice amount. Card and bank details are entered on Stripe's pages and never reach Verdikx | Only for workspaces billed by card and Enterprise customers invoiced through Stripe; Shopify stores are billed through Shopify Billing |
| Google (sign-in) | Sign in with Google for merchant accounts and the Verdikx team console | Google account email address, name and account identifier returned at sign-in | Only if the person chooses to sign in with Google |
Connected at the merchant’s choice, or when configured
| Provider | Purpose | Data categories | When used |
|---|---|---|---|
| Microsoft (sign-in) | Sign in with Microsoft (Microsoft Entra ID, through Supabase Auth) for merchant accounts | Your Microsoft account email address, name and account identifier returned at sign-in | Only if you choose to sign in with Microsoft |
| Stripe | Optional connection to import Stripe disputes and early fraud warnings and submit evidence you approve | Stripe dispute and payment records and the evidence you choose to submit | Only if you connect a Stripe account |
| PayPal | Optional connection to import PayPal disputes and inquiries and submit evidence you approve | PayPal dispute and transaction records, including buyer name and email; the evidence you choose to submit | Only if you connect PayPal |
| Square | Optional connection to import Square disputes and submit evidence you approve | Square dispute and payment records; the evidence you choose to submit | Only if you connect Square |
| Braintree (PayPal) | Optional connection to import Braintree disputes and submit evidence you approve | Braintree dispute and transaction records, including customer email; the evidence you choose to submit | Only if you connect Braintree |
| Adyen | Optional connection to import Adyen disputes and submit evidence you approve | Adyen dispute notifications and payment references; the evidence you choose to submit | Only if you connect Adyen |
| Checkout.com | Optional connection to import Checkout.com disputes and submit evidence you approve | Checkout.com dispute and payment records; the evidence you choose to submit | Only if you connect Checkout.com |
| Authorize.net | Optional connection to import Authorize.net chargebacks for manual response | Chargeback and transaction records, including customer email and billing details returned by Authorize.net | Only if you connect Authorize.net |
| Klarna | Optional connection to import Klarna disputes and submit evidence you approve | Klarna dispute records, order references and the evidence you choose to submit | Only if you connect Klarna |
| Afterpay / Clearpay | Optional connection to import Afterpay or Clearpay disputes and submit evidence you approve | Dispute records, order references and the evidence you choose to submit | Only if you connect Afterpay or Clearpay |
| Affirm, Airwallex, Cybersource, Mollie, Primer, Rapyd and Worldpay (beta) | Optional connections to import disputes from these processors and, where the processor accepts evidence by API (Affirm, Airwallex, Worldpay), submit evidence you approve | Dispute and payment records, which can include the buyer's name and email; the evidence you choose to submit | Only if you connect the processor |
| Razorpay, Mercado Pago, Amazon Pay and Shift4 (beta) | Optional connections to import disputes from these processors and submit evidence you approve through each processor's evidence API | Dispute and payment records, which can include the buyer's name and email; the evidence you choose to submit | Only if you connect the processor |
| WooCommerce (your own store) | Optional connection to import orders and disputes from your WooCommerce store | Orders, customers (email, name, addresses) and fulfillment details read from your store's REST API | Only if you connect a WooCommerce store |
| Rutter | Optional connection to import orders from your other sales channels | Orders from connected channels, including customer email, items, totals and fulfillment details | Only if you connect a sales channel |
| commercetools, Miva and VTEX (beta) | Optional connection to import orders from these commerce platforms | Orders, including customer email, name, addresses, items, totals and fulfillment details | Only if you connect the platform |
| Gorgias | Optional help desk connection to attach customer conversations as evidence | Tickets and messages with the customer, including name and email | Only if you connect Gorgias |
| Zendesk | Optional help desk connection to attach customer conversations as evidence | Tickets and messages with the customer, including name and email | Only if you connect Zendesk |
| Intercom | Optional help desk connection to attach customer conversations as evidence | Conversations with the customer, including name and email | Only if you connect Intercom |
| Google (Gmail API) | Optional mailbox connection to attach customer email threads as evidence | Email messages exchanged with the customer, read-only | Only if you connect a Gmail account |
| Merge.dev | Optional unified connection to other help desks | Tickets and messages with the customer, including name and email | Only if you connect a help desk through Merge |
| Freshdesk, Help Scout, LiveAgent and Re:amaze (beta) | Optional help desk connections to attach customer conversations as evidence | Tickets and messages with the customer, including name and email | Only if you connect the help desk |
| Front and Kustomer (beta) | Optional help desk connections to attach customer conversations as evidence, read with the API token or key you create | Conversations, messages and internal notes with the customer, including name and email | Only if you connect the help desk |
| Recharge | Optional subscription-history evidence | Subscription and charge history for the disputed customer | Only if you connect Recharge |
| Skio | Optional subscription-history evidence | Subscription and order history for the disputed customer | Only if you connect Skio |
| Loop Returns | Optional returns evidence | Return and exchange records for the disputed order | Only if you connect Loop Returns |
| Bold, Chargebee, NetSuite and Recurly (beta) | Optional subscription, billing and order-history evidence | Subscription, invoice, charge and order history for the disputed customer | Only if you connect the service |
| AfterShip | Optional shipment tracking evidence | Tracking numbers and returned tracking events | Only if you connect AfterShip |
| ShipStation, EasyPost and ShipBob (beta) | Optional shipping evidence from your own shipping or fulfillment account, read with the API key or token you create | Order and tracking references; returned shipment records (ship date, carrier, service and tracking number) and tracking events. Recipient names and addresses are not stored | Only if you connect the service |
| 17TRACK (beta) | Optional shipment tracking evidence with your own 17TRACK API key | Tracking numbers (registered with 17TRACK under your account) and the returned tracking events | Only if you connect 17TRACK |
| Postmark | Inbound email: receiving the dispute and alert emails you forward to your Verdikx intake address | The forwarded email, including sender, recipients, text and attachments | Only if you forward email to your intake address and Postmark is the inbound email provider configured for the deployment |
| SendGrid (Twilio) | Inbound email: receiving the dispute and alert emails you forward to your Verdikx intake address | The forwarded email, including sender, recipients, text and attachments | Only if you forward email to your intake address and SendGrid is the inbound email provider configured for the deployment |
| SEON | Optional fraud-data enrichment for order screening, using the merchant's own SEON licence key | For each screened order: buyer email, phone number and checkout IP address, order amount, billing and shipping country and the order id. SEON's verdict is stored with the screening result | Only if a merchant connects SEON and turns it on |
| Pre-dispute alert providers (Ethoca, Verifi RDR and CDRN, Chargebacks911, Midigator, Kount) | Receiving pre-dispute alerts that the merchant's alert provider sends to Verdikx | Alert details such as the alert type, amount, currency, transaction or order reference and outcome, plus the buyer's email address and the card's last four digits when the provider includes them (used to match the alert to an order) | Only if a merchant routes alerts to Verdikx |
| Shippo | Shipment tracking scans | Carrier name and tracking number. Recipient names in scan text are removed; addresses are not retained | When tracking is checked for a supported carrier |
| UPS, FedEx, USPS (direct carrier APIs) | Tracking and, where authorized, proof-of-delivery documents | Tracking numbers; returned tracking events and authorized delivery documents | Only where direct carrier access is configured |
| Twilio | SMS notifications | Recipient phone number and notification text | Only if SMS notifications are configured |
| Cloudflare (Turnstile) | Bot protection on website sign-in, sign-up and password reset, and on the public early access, careers, and privacy request forms | IP address and technical browser details used to tell people from automated traffic; not the account or form contents | When bot protection is configured for the deployment (never inside Shopify admin) |
Changes to this list
We update this page before a new subprocessor starts processing merchant data. Merchants who have signed our Data Processing Addendum (listed in the Trust Center) are also notified as it describes. Questions: privacy@verdikx.com.