Last updated 8 September 2026
Wave Corporate Finance engages the third parties below to operate the Wave investor portal (the “Portal”).
This page is the list referred to in article 6.1 and Annex 1 of the Wave portal data processing agreement. It is the authoritative version at any given time.
| Subprocessor | Purpose | Processing location | Security certification |
|---|---|---|---|
| Supabase, Inc. | Database, authentication and document storage | European Union (Frankfurt, Germany) | SOC 2 Type II, ISO 27001 |
| Vercel Inc. | Application hosting and content delivery | European Union (Frankfurt, Germany), with support access from the United States | SOC 2 Type II, ISO 27001 |
| Resend (Plus Five Five, Inc.) | Delivery of service and notification email. No access to the investor register or to investor documents | European Union (Ireland), with support access from the United States | SOC 2 Type II |
| Microsoft Ireland Operations Limited | Wave's business email and document storage, used for support correspondence and for Wave's own copy of investor documents | European Union | SOC 2 Type II, ISO 27001 |
| Anthropic PBC | Assistance with the preparation and classification of investor documents, on instruction. Inputs are not used for model training | United States, under the European Commission's standard contractual clauses | SOC 2 Type II, ISO 27001, ISO 42001 |
We give each customer at least thirty (30) days’ written notice before a new subprocessor processes personal data. The notice goes by email to the address named in their data processing agreement. A change to this page is not by itself that notice.
A customer may object on reasonable grounds relating to data protection within fourteen (14) days of that notice. If we cannot resolve the objection together, the customer may end the affected Portal services, and neither side owes the other compensation for that ending.
Where a subprocessor is established outside the European Economic Area, we rely on the European Commission’s standard contractual clauses or on an applicable adequacy decision. We make the relevant transfer documentation available on request.
Every change to this list is recorded here, so a customer can establish what the list stated on any date.