Subprocessor list
We share the minimum data needed with each sub-processor. The list below identifies the legal entity, country, what we share, retention, and DPA status. We commit to 30 calendar days' prior notice of any new sub-processor, by email and in-product notification. If you object on reasonable data-protection grounds, you may terminate the affected services and receive a pro-rata refund, or terminate the entire MSA with 90 days' transition assistance.
| # | Sub-processor | Country | Data shared | Purpose | Retention | DPA |
|---|---|---|---|---|---|---|
| 1 | Cloudflare Inc. (R2, Workers, Pages, Email Routing) | US (with EU/APAC edge) | Audit report PDFs, raw JSON, telemetry, transactional email | Hosting, storage, email routing | Customer-controlled | Click-to-sign DPA |
| 2 | OpenAI OpCo LLC (API) | US | Prompt text (audit queries) and the 30-50 brand mentions being tested | AI-search query execution (ChatGPT model endpoint) | Retention / training controls configured per account; status disclosed per run | DPA / account settings reviewed before real delivery |
| 3 | X.AI LLC (xAI API) | US | Prompt text and the 30-50 brand mentions being tested | AI-search query execution (Grok model endpoint) | 30-day API abuse / misuse audit retention by default; ZDR enterprise setting where enabled; status disclosed per run | Terms / account settings reviewed before real delivery |
| 4 | Anthropic PBC (API) | US | Prompt text and the 30-50 brand mentions being tested | AI-search query execution (Claude model endpoint) | Retention / training controls configured per account; status disclosed per run | DPA / account settings reviewed before real delivery |
| 5 | Google LLC (Vertex AI / Gemini API) | US | Prompt text and the 30-50 brand mentions being tested | AI-search query execution (Gemini model endpoint) | Enterprise data controls configured per account; status disclosed per run | Cloud Data Processing Addendum / account settings reviewed before real delivery |
| 6 | ByteDance Volcengine (Ark API) | CN | Customer prompt text and brand mentions | AI-search query execution (Doubao model endpoint) | Retention / training controls configured per account; status disclosed per run | Commercial data-processing terms reviewed before real delivery |
| 7 | Moonshot AI Inc. (Kimi API) | CN | Customer prompt text and brand mentions | AI-search query execution (Kimi model endpoint) | Retention / training controls configured per account; status disclosed per run | Commercial data-processing terms reviewed before real delivery |
| 8 | DeepSeek (API) | CN | Customer prompt text and brand mentions | AI-search query execution (DeepSeek model endpoint) | No-retention setting / header where available; status disclosed per run | Commercial terms + account setting reviewed before real delivery |
| 9 | Alibaba Cloud / DashScope (Qwen API) | CN | Customer prompt text and brand mentions | AI-search query execution (Qwen model endpoint) | 0 via no-log setting | Commercial terms + account setting reviewed before real delivery |
| 10 | Resend Inc. | US (with EU edge) | Customer email address, audit report PDF (as attachment or link) | Transactional email delivery | 30 d (delivery logs) | Standard Resend DPA |
Vendors we explicitly do not use
For full transparency, here is what we are not doing in v1.0:
- No Paddle / Lemon Squeezy / 2Checkout — we invoice and collect directly. (See MSA §6.)
- No Google Analytics, no Facebook Pixel, no retargeting or ad-tech cookies. Telemetry is via Plausible or self-hosted, cookieless.
- No customer-data training by Clarivy; LLM vendor retention / training-control status is reviewed before real delivery and disclosed in the report's data provenance where relevant.
- No Facebook / Twitter / LinkedIn login — only email + password (or magic link) via Cloudflare Access or equivalent.
Subscribe to change notifications
Email [email protected] with subject "Subscribe to subprocessor changes" to receive every update by email. We commit to 30 days' prior notice; the change will be reflected on this page on the effective date.
Subprocessor list v1.1 effective 26 June 2026. Next scheduled review 26 September 2026.