Subprocessors

In the analysis path

These process the material your analyses are built from:

• OpenAI (United States) — language-model extraction and scoring. Receives the cleaned text of sources you confirmed, which may contain names, quotations and professional detail. We do not opt into training; request content is retained up to 30 days for abuse monitoring, then deleted.
• Tavily (United States) — web search for source discovery. Receives search queries built from company and person names, and returns candidate pages.
• LinkdAPI — LinkedIn enrichment for a profile URL, only where enabled and requested. Currently disabled. We never crawl LinkedIn directly.

Running the service

These keep the platform online and handle your account:

• Railway — hosting for the application and the PostgreSQL database. All workspace data lives here at rest.
• Resend (United States) — transactional email: address verification and password resets.
• Stripe (Ireland, with US group processing) — subscription payments. Receives billing contact, address and VAT number. Card details never reach our servers.

Internal operations

These see operational data, not analysis content:

• Slack (United States) — notifications when an access request arrives, and alerts when the pipeline degrades or an error goes unhandled.
• Sentry (United States) — error tracking. Currently dormant; it activates only if we configure it, and it is set up to capture no personal data.

Transfers outside the EEA

Several of the above are established in the United States. Where personal data reaches them, the transfer is governed by that provider's data processing terms, which incorporate the European Commission's Standard Contractual Clauses and, for some providers, certification under the EU–US Data Privacy Framework. We are completing our own record of the mechanism relied on for each provider, and this page will state it per provider once that is done.

Changes to this list

We notify active customers by email and update this page at least 30 days before a new subprocessor starts. If you object on reasonable data-protection grounds and we cannot resolve it, you may terminate the affected part of the service without penalty and receive a pro-rata refund.