Effective date: August 8, 2026
We engage the service providers below to process customer data as part of delivering the service. Each is bound by appropriate confidentiality and data-protection obligations. This list is maintained under our Data Processing Addendum.
| Provider | Purpose | Location |
|---|---|---|
| Vercel Inc. | Application hosting, serverless compute, and content delivery. | United States |
| Supabase, Inc. | Managed PostgreSQL database, authentication, and encrypted file storage for customer content. | United States |
| Anthropic, PBC | AI-assisted features (Claude). Content sent for AI assistance is not used to train foundation models. | United States |
| Functional Software, Inc. (Sentry) | Application error monitoring and diagnostics. Configured to avoid capturing customer record content in error payloads. | United States |
| Transactional email delivery (SMTP relay) | Delivery of platform notification and invitation emails (assessment invites, digests, reminders).Customers who configure their own Microsoft 365 (Microsoft Graph) sender deliver email through their own tenant rather than this relay. | United States |
These are not subprocessors. When your organization supplies its own API keys or credentials for an external service, data you direct the service to send there is processed at your direction, under your own agreement with that provider:
We may update this list as our providers change. Under our Data Processing Addendum, we provide notice before adding a new subprocessor so customers may object on reasonable data-protection grounds. Questions may be sent to privacy@risqradar.com.