OpsFi engages the following sub-processors to operate Diligence Forge. Each is bound by a data-processing contract; non-UK/EEA processing relies on the UK IDTA / EU SCCs. AI and OCR providers receive content transiently for the specific request only and are not authorised to train on it.
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Database / Auth / Storage / Realtime | EU (eu-west-1) |
| Anthropic | AI analysis & drafting (transient) | US |
| Vercel | Frontend hosting + consent-gated analytics | US / edge |
| Railway | Backend (API) hosting | US |
| Resend | Transactional email | US |
| Documenso | E-signature | To be confirmed |
| Voyage AI | Text embeddings (transient) | US |
| Google Cloud Vision | OCR for scanned PDFs (transient) | US / global |
| Companies House | UK company-registry lookups (public) | UK |
| SEC (EDGAR) | US filings lookups (public) | US |