{
  "$schema": "https://trustvice.com/schemas/sub-processors/v1.json",
  "x-trustvice-policy": "https://github.com/99industries/trustvice-audit/blob/main/docs/audit/19-sub-processor-inventory.md",
  "x-trustvice-status": "published",
  "x-trustvice-note": "Trustvice's authoritative sub-processor inventory. Customers are notified ≥30 days before any addition; objections accepted via privacy@trustvice.com. Model providers are listed because Trustvice's own API key is used when a workspace has not supplied one; where a workspace brings its own key (BYOK) or points an agent at the LLM proxy with an inline provider key, that provider is the customer's sub-processor and not Trustvice's.",
  "subProcessors": [
    {
      "name": "Cloudflare, Inc.",
      "purpose": "Compute (Workers), database (D1), object storage (R2), KV cache, message queues, edge DNS, Access (zero-trust proxy).",
      "dataCategories": [
        "Customer records (ingest + audit log)",
        "Exports",
        "Operational logs"
      ],
      "processingRegions": [
        "WEUR (Frankfurt + Amsterdam)",
        "ENAM (Ashburn + San Jose)"
      ],
      "legalBasis": "GDPR Art. 28 DPA + EU SCCs Module 2; UK IDTA",
      "url": "https://www.cloudflare.com/cloudflare-customer-dpa/",
      "attestations": [
        "SOC 2 Type II",
        "ISO 27001",
        "ISO 27018",
        "PCI DSS Level 1"
      ]
    },
    {
      "name": "Amazon Web Services, Inc.",
      "purpose": "Optional per-workspace isolated database (Aurora Serverless v2 over the RDS Data API — alternative to Cloudflare D1 at workspace creation).",
      "dataCategories": [
        "Customer records (ingest + audit log)"
      ],
      "processingRegions": [
        "Customer-selectable per workspace (26 AWS regions)"
      ],
      "legalBasis": "GDPR Art. 28 DPA (AWS GDPR DPA, incorporated into the AWS Service Terms) + EU SCCs",
      "url": "https://aws.amazon.com/compliance/gdpr-center/",
      "attestations": [
        "SOC 1/2/3",
        "ISO 27001",
        "ISO 27017",
        "ISO 27018",
        "PCI DSS Level 1"
      ]
    },
    {
      "name": "Stripe, Inc. / Stripe Payments Europe Ltd.",
      "purpose": "Payment processing, billing, hosted Checkout, Customer Portal, Radar fraud signals.",
      "dataCategories": [
        "Billing identity",
        "Payment instrument metadata",
        "Stripe Radar fraud envelope"
      ],
      "processingRegions": [
        "US (Stripe Inc.)",
        "EU (Stripe Payments Europe)"
      ],
      "legalBasis": "GDPR Art. 28 DPA + EU SCCs Module 2",
      "url": "https://stripe.com/legal/dpa",
      "attestations": [
        "PCI DSS Level 1",
        "SOC 1 Type II",
        "SOC 2 Type II",
        "ISO 27001"
      ]
    },
    {
      "name": "Vercel Inc.",
      "purpose": "Marketing site + customer dashboard frontend hosting (Next.js SSR + static assets).",
      "dataCategories": [
        "No customer record content; session cookie metadata only"
      ],
      "processingRegions": [
        "US + EU edge"
      ],
      "legalBasis": "GDPR Art. 28 DPA + EU SCCs Module 2",
      "url": "https://vercel.com/legal/dpa",
      "attestations": [
        "SOC 2 Type II"
      ]
    },
    {
      "name": "Resend Labs Inc.",
      "purpose": "Transactional email (magic links, billing receipts, alert digests, legal-override notifications).",
      "dataCategories": [
        "Email address",
        "Email contents"
      ],
      "processingRegions": [
        "US"
      ],
      "legalBasis": "GDPR Art. 28 DPA + EU SCCs Module 2",
      "url": "https://resend.com/legal/dpa",
      "attestations": [
        "SOC 2 Type II"
      ]
    },
    {
      "name": "Anthropic PBC",
      "purpose": "Model inference for Number One (primary provider) and the ActionFlow conversational composer. Processes the prompt and the customer content included in it.",
      "dataCategories": [
        "Conversation content",
        "Workspace configuration named in a prompt",
        "Flow descriptions"
      ],
      "processingRegions": [
        "US"
      ],
      "legalBasis": "GDPR Art. 28 DPA + EU SCCs Module 2",
      "url": "https://www.anthropic.com/legal/commercial-terms",
      "attestations": [
        "SOC 2 Type II",
        "ISO 27001"
      ]
    },
    {
      "name": "OpenAI, L.L.C.",
      "purpose": "Model inference as a Number One failover provider, used only when configured and when the primary is unavailable.",
      "dataCategories": [
        "Conversation content",
        "Workspace configuration named in a prompt"
      ],
      "processingRegions": [
        "US"
      ],
      "legalBasis": "GDPR Art. 28 DPA + EU SCCs Module 2",
      "url": "https://openai.com/policies/data-processing-addendum",
      "attestations": [
        "SOC 2 Type II"
      ]
    },
    {
      "name": "Google LLC (Gemini API)",
      "purpose": "Model inference as a Number One failover provider, used only when configured and when the primary is unavailable.",
      "dataCategories": [
        "Conversation content",
        "Workspace configuration named in a prompt"
      ],
      "processingRegions": [
        "US"
      ],
      "legalBasis": "GDPR Art. 28 DPA + EU SCCs Module 2",
      "url": "https://cloud.google.com/terms/data-processing-addendum",
      "attestations": [
        "SOC 2 Type II",
        "ISO 27001",
        "ISO 27018"
      ]
    },
    {
      "name": "Mistral AI SAS",
      "purpose": "Model inference as a Number One failover provider, used only when configured and when the primary is unavailable.",
      "dataCategories": [
        "Conversation content",
        "Workspace configuration named in a prompt"
      ],
      "processingRegions": [
        "EU (France)"
      ],
      "legalBasis": "GDPR Art. 28 DPA (EU-established processor; no transfer mechanism required)",
      "url": "https://mistral.ai/terms/",
      "attestations": [
        "SOC 2 Type II"
      ]
    },
    {
      "name": "DigiCert, Inc.",
      "purpose": "RFC 3161 Time-Stamp Authority for C2PA + Notarian + audit-log periodic anchoring (per audit policy 28 §5c).",
      "dataCategories": [
        "SHA-256 digests; no customer payload"
      ],
      "processingRegions": [
        "US"
      ],
      "legalBasis": "Industry-standard service — no GDPR data processed",
      "url": "https://www.digicert.com/legal-repository",
      "attestations": [
        "WebTrust",
        "ETSI EN 319 411"
      ]
    }
  ],
  "fraudDetectionProviders": "See /.well-known/fraud-providers.json for the 7-provider approved set per audit policy 38 §3."
}