EvidEpi LLC uses the third-party services below. Those in the first table operate Havast itself and handle customer content or account data. Those in the second are used only on our public website and receive neither. This page is kept current. If you hold a Data Processing Addendum with us, changes to this list are notified under it.
Last updated 10 September 2026.
| Provider | Purpose | Data reaching it | Region |
|---|---|---|---|
| Anthropic, PBC | AI extraction. Uploaded documents and the extraction prompt are sent to the model. | Document content; extraction configuration | United States |
| Supabase Inc. | Database, authentication and file storage. | Account data; project data; uploaded documents | United States |
| Render Services, Inc. | Application hosting. | Data in transit through the application | United States |
A document uploaded for AI extraction is transferred to Anthropic's Files API so the model can read it. Havast deletes that provider-side copy after the extraction finishes, on both the success and the failure path, and a sweeper removes any copy that a crashed run left behind. Retention of the request and response themselves is governed by our agreement with the provider, described on the Trust page.
Account identifiers, billing records and usage history stay within our own infrastructure. They are not sent to the model provider.
These providers are used only on the public pages of evidepi.com. They receive no customer content, no account data and no part of any uploaded document. Nothing here runs inside Havast: no page behind sign-in loads either of them.
| Provider | Purpose | Data reaching it | Region |
|---|---|---|---|
| Google LLC | Website analytics on the public pages. Runs with every storage category denied: no cookie is set and nothing is written to a visitor's browser. | Page address and title; approximate location derived from IP address; device and browser characteristics | United States |
| Google LLC (YouTube) | The demonstration video on the Havast product page. Nothing is requested from YouTube unless a visitor presses play. | IP address, and playback data under YouTube's own terms, once play is pressed | United States |