The vetted third parties that help us deliver the service, each bound by data-protection obligations no less protective than those in our Data Processing.
Application hosting, edge network, and content delivery. Vercel maintains its own independently audited SOC 2 attestation and ISO/IEC 27001 certification, and runs on Amazon Web Services (AWS) infrastructure that holds the same attestation and certification.
United States
Managed database, authentication, and document storage. Supabase maintains an independently audited SOC 2 attestation and ISO/IEC 27001 certification, and runs on Amazon Web Services (AWS) infrastructure that holds the same attestation and certification.
United States
AI-powered analysis of documents and questionnaires submitted for risk assessment (Gemini API), bot protection on public forms (reCAPTCHA), and demo-scheduling emails and calendar invitations (Gmail and Google Calendar). Google maintains an independently audited SOC 2 attestation and ISO/IEC 27001 certification.
United States
Transactional and notification email delivery. Resend maintains an independently audited SOC 2 attestation.
United States
Application error and performance monitoring. Receives diagnostic event data so we can detect and resolve faults; personal data is scrubbed before transmission. Sentry maintains an independently audited SOC 2 attestation and ISO/IEC 27001 certification.
United States
Sanctions and politically-exposed-person (PEP) screening. When an AML screening is run, the vendor's legal name and country are sent to the OpenSanctions matching API to check against consolidated OFAC, EU, UN, and UK sanctions lists. No other personal data is transmitted.
European Union (Germany)
Adverse-media monitoring. The vendor's name and industry are sent as a news search query to surface negative press. No personal data is transmitted.
United Kingdom
Regulatory enforcement screening. A keyword from the vendor's business name is sent to the OCC's public enforcement-action search to identify related orders. No personal data is transmitted.
United States
We provide notice of material changes to this list. For questions about our subprocessors, contact support@riskshieldai.com.