Sub-processors
Last updated 19 October 2026
These providers process data so that Audit Assistant can run. Each has written terms with us, and none may use your data for its own purposes or to train AI models. We give customers 30 days' notice before adding a sub-processor.
| Provider | What it does | Data it receives | Location |
|---|---|---|---|
| Anthropic | AI models (Claude), the main AI provider | The text needed for each AI action, with the identifiers in Privacy section 4 masked | United States |
| OpenAI | Search embeddings; backup AI provider during an Anthropic outage only | Masked document passages and search queries; masked AI text during an outage | United States |
| Second backup AI provider, only if enabled | As OpenAI, if used. [Not enabled today.] | United States | |
| Supabase | Database, file storage and sign-in | All application data and uploaded files | European Union [confirm region] |
| Railway | Runs the application servers and background jobs | All data, while it is processed | [confirm region] |
| Vercel | Serves the web app | Pages and requests in transit | Global edge network |
| Stripe | Payments for credit packs | Buyer's email, organisation reference, pack and amount. No audit data, and we never see card details | United States / Ireland |
Planned:
| Provider | What it will do | Data it will receive |
|---|---|---|
| Resend | Account and notification emails | Recipient name and email, sign-in links, and engagement titles in notifications |
Last changed: 19 October 2026.