Subprocessors
Last updated 2026-09-24
These are the third parties that process customer personal data on our behalf. We give customers notice before adding one, as our DPA requires.
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Railway Corporation | Application hosting: web servers, background workers, PostgreSQL database and Redis queue. | All customer data held in the application database, in transit through the application. | United States |
| DigitalOcean, LLC | Object storage (Spaces) for uploaded evidence documents and data-export archives. | Uploaded documents and export archives, encrypted at rest. | United States |
| Resend, Inc. | Transactional email: sign-in, invitations, questionnaire links, reminders, notices. | Recipient email addresses and the content of the emails we send. | United States |
| Anthropic, PBC | AI analysis of uploaded evidence and drafting of assessment narratives.Only for organizations on a plan with AI analysis, when an analysis is requested. | Extracted text of documents you choose to analyse, and assessment context. Not used to train models. | United States |
| Stripe, Inc. | Subscription billing and payment processing.Only for organizations on a paid plan. | Billing contact name and email, organization name, payment card details (held by Stripe, never by us). | United States |
| Functional Software, Inc. (Sentry) | Error monitoring for the application. | Stack traces and request metadata. Request bodies and personal data are excluded by configuration. | United States |