Subprocessors

Clients under a data processing agreement receive advance notice of any addition to this list, with a window to object. The notice period and objection mechanism are set out in the DPA. Where a client is itself a processor, its own client's approval rights are respected.

This is what we deliver.

• Cloud infrastructure and hosting — compute, storage and networking. Processes: case data.
• Model inference provider — language model serving under zero-retention terms. Processes: case data.
• Error and performance monitoring — application telemetry, configured to exclude case data. Processes: operational metadata.
• Transactional email — account and notification email. Processes: business contact data only.
• Customer relationship management — sales and support records. Processes: business contact data only.

Only subprocessors explicitly designated as case-data handling receive adverse-event data, and each is bound by downstream terms no less protective than our own DPA — including the prohibition on training. The remainder are contractually and technically scoped to business contact data and operational telemetry.