Subprocessors
Last updated 2026-08-11
AuditAI engages the third-party processors listed below to deliver the Service. We notify customers at least 30 days before adding a new subprocessor that processes personal data on Customer's behalf. Customers can subscribe to change notifications by emailing privacy@auditai.example.
| Vendor | Purpose | Data categories | Region | DPA |
|---|---|---|---|---|
| Anthropic, PBC | AI model provider (Claude Sonnet/Opus/Haiku) for finding drafting, classification, and summary generation. | Prompts and completions in transit; not retained when AuditAI's account has Zero Data Retention enabled. | United States (Bedrock VPC routing optional for enterprise) | Link |
| Clerk, Inc. | Authentication, organisation management, MFA, and SSO. | User name, email, profile picture, sign-in metadata. | United States | Link |
| Stripe, Inc. | Payment processing, subscription billing, customer portal, automatic tax. | Customer name, billing email, billing address, card last four, country. | United States, EU (per customer location) | Link |
| Resend, Inc. | Transactional email delivery (survey invites, report-ready notifications, billing alerts). | Recipient email, subject line, message body. | United States | Link |
| Supabase, Inc. | Managed PostgreSQL database hosting with PITR backups, and object storage for evidence files. | All Customer Data persisted in the application; evidence file contents and metadata. | United States (us-east-2) by default; EU region available. | Link |
| Vercel, Inc. | Application hosting and serverless function execution. | All request-time data flowing through the application; access logs; metadata. | Global edge with primary in United States. | Link |
| Inngest, Inc. | Background job execution (cron, retries, durable workflows). | Event payloads sent to background workers. | United States | Link |
| Functional Software, Inc. (Sentry) | Application error tracking and performance monitoring. | Stack traces, request metadata, redacted user contexts. PII is scrubbed via beforeSend. | United States | Link |
| PostHog, Inc. | Product analytics, feature-flag delivery. Routed to PostHog EU for EU-located users. | Pageviews, action events, anonymous IDs (consent-gated in EU/UK/CA). | United States (us.i.posthog.com) and EU (eu.i.posthog.com) | Link |
| Upstash, Inc. | Distributed rate limiting (Redis). | Rate-limit identifiers (hashed user id or IP). No personal content. | Global, region pinned per deployment. | Link |
Onward transfer mechanism
Where a subprocessor processes personal data outside the EEA, UK, or Switzerland from a region requiring a transfer mechanism, AuditAI relies on the EU SCCs and the UK IDTA. The DPA at /legal/dpa describes the modules, choices, and forum.
Change history
- 2026-08-11 - Initial publication.