← Back to home

Sub-processor Register

Version 2026-05-16

Draft — pending legal review. This document is an engineering-prepared draft and is not legal advice. It is published in versioned form for transparency while qualified counsel reviews and finalises it. For the current authoritative position contact privacy@opsfi.co.

OpsFi engages the following sub-processors to operate Diligence Forge. Each is bound by a data-processing contract. Customers under a DPA are notified of changes per that DPA.

Sub-processor Service / purpose Data exposed Location (to confirm) Transfer mechanism (counsel to confirm)
Supabase Primary database, Auth, Storage, Realtime All platform data (RLS tenant-isolated), credentials, uploaded documents EU (eu-west-1) Intra-EEA / UK adequacy
Anthropic AI analysis, drafting, summarisation (Claude) Transient: the content of the specific AI request US UK IDTA / EU SCCs
Google (Gemini) AI analysis and drafting (governed model router, where enabled by an organisation) Transient: the content of the specific AI request US/global (to confirm) UK IDTA / EU SCCs (to confirm)
xAI AI analysis and drafting (governed model router, where enabled by an organisation) Transient: the content of the specific AI request US (to confirm) UK IDTA / EU SCCs (to confirm)
Vercel Frontend hosting + privacy-friendly performance analytics (consent-gated) Request metadata; aggregate web-vitals US/global edge UK IDTA / EU SCCs
Railway Backend (FastAPI) hosting All request data in transit through the API US UK IDTA / EU SCCs
Resend Transactional email delivery Recipient email, message content US UK IDTA / EU SCCs
Documenso E-signature for engagement letters Signer name/email, document To confirm UK IDTA / EU SCCs
Voyage AI Text embeddings for document/corpus search Transient: chunked document text US UK IDTA / EU SCCs
Google Cloud Vision OCR for scanned/image PDFs Transient: uploaded document images US/global UK IDTA / EU SCCs
Companies House UK company-registry lookups (external intelligence) Target-company identifiers (public data) UK N/A (public registry)
SEC (EDGAR) US filings lookups (external intelligence) Target-company identifiers (public data) US N/A (public registry)

Notes for counsel:

  • Anthropic / Google / xAI / Voyage / Vision receive transient content for the specific request only; we do not authorise model training on customer content. The governed model router routes each request to one of the three enabled AI providers (Anthropic, xAI, Google); organisations may restrict or block providers and models in Model Tools. OpenAI is not an enabled provider: every OpenAI model is blocked in the router catalogue and no request has been routed to OpenAI since June 2026, so it is not listed. Counsel to confirm the contracting entity, processing location and transfer mechanism for Google and xAI, and whether the DPA annex requires customer notification for their addition.
  • Supabase is the system of record and is EU-hosted (eu-west-1); confirm the contracting Supabase entity and whether any sub-processing leaves the EEA.
  • Companies House and SEC are public registries queried for target-company data; classify whether this is "sub-processing" of personal data at all.
  • Add any analytics/error-reporting provider introduced by W4.14 (Sentry or equivalent) to this register before that ships.

Change notification & objection process to be defined in the DPA.