Legal · Sub-processors
Sub-processors
Last updated · April 28, 2026 · Last reviewed · June 10, 2026
Every vendor who touches customer data, what they're used for, where they store it, and what specifically they see. Updated whenever the list changes — at least 30 days before any new vendor goes live.
Current sub-processors
Nine vendors. No surprises.
Most of these are foundational infrastructure. A handful are the AI models we measure on your behalf — we use their public APIs and never embed customer data in training calls.
| Vendor | Purpose | Region | What data is shared |
|---|---|---|---|
Cloudflare cloudflare.com | Edge compute, CDN, WAF, DDoS protection, R2 storage, D1 database, Workers KV. | Global edge | All customer requests transit the edge. Storage is U.S.-region by default. |
OpenAI openai.com | ChatGPT API queries for consensus scoring (GPT-4, GPT-4o). | US | Generated scan queries only. No customer PII. We use the API tier, not consumer ChatGPT. |
Google AI (Gemini) ai.google.dev | Gemini API queries for consensus scoring. | US | Generated scan queries only. No customer PII. |
Anthropic anthropic.com | Claude API queries for consensus scoring. | US | Generated scan queries only. No customer PII. |
Perplexity perplexity.ai | Perplexity API queries for consensus scoring with web search. | US | Generated scan queries only. No customer PII. |
PlanetScale planetscale.com | Primary relational database for accounts, scans, reports, billing references. | US | Account data, scan metadata, report indexes. Encrypted at rest by the provider. |
Stripe stripe.com | Payment processing, subscription management, invoicing. | Global | Billing email, card token, subscription state. We never see card numbers. |
Postmark postmarkapp.com | Transactional and notification email delivery. | US | Recipient email, subject, body of system-generated emails. |
PostHog posthog.com | First-party product analytics (server-side event capture). | US | Account identifiers, pricing-funnel events, feature-usage counts. No card data, no scan content. |
Backblaze B2 backblaze.com | Long-term storage for archived reports and audit logs. | US-West | Archived scan artifacts. Encrypted at rest by the provider. |
i
How we add or change vendors.
Before adding a new sub-processor, we publish a notice on this page and email customers on monitoring plans at least 30 days in advance. Enterprise customers with signed DPAs receive direct notice. If you have objections, write to privacy@misquoted.ai — we'll work with you on alternatives where feasible.