Sub-processors
Every third party RM Assistant relies on to deliver the platform, what each receives, and where it operates. Published so vendor review does not require a phone call.
Last updated: 16 August 2026
A sub-processor is a third party that processes customer data on our behalf in order to deliver the service. Each one below is engaged under a written agreement imposing data protection obligations no less protective than those in our data processing agreement, and each receives only the data it needs for the stated purpose.
Current sub-processors
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Amazon Web Services | Cloud hosting, compute, database and document storage | All customer data, including submission documents and extracted records | United States (us-east-2) |
| OpenAI | Document classification and data extraction from submission documents | Submission document contents submitted for processing | United States |
| Cloudflare | DNS, CDN, website hosting, TLS termination and bot protection | Network traffic metadata; website form submissions in transit | Global edge network |
| Resend | Transactional and notification email delivery | Recipient email address and message contents | United States |
| Central Analysis Bureau (CAB) | Motor-carrier data lookup and verification for commercial trucking risks | Carrier identifiers such as DOT and MC numbers, and carrier name | United States |
| NHTSA vPIC | Vehicle identification number decoding | VINs only | United States (public government service) |
| Attio | Customer relationship management for website enquiries | Website demo-request contact details only. No submission data. | United States / European Union |
| Slack | Internal notification of website enquiries | Website demo-request contact details only. No submission data. | United States |
Notes worth reading
AI processing does not train third-party models
Submission documents are sent to our AI provider under commercial API terms that do not permit the content to be used for training. Extraction results return to your isolated tenant environment. Customer data is never pooled across customers.
CRM and notification tools never receive submission data
Attio and Slack receive contact details from website enquiries only — a name, work email, company and whatever you typed into the form. No insurance submission, document or extracted record ever reaches them.
Your policy administration system is not our sub-processor
When we push a structured record into your Vertafore IMS, Dayd ALIS, Guidewire or custom endpoint, that is your system receiving your data at your instruction. It is a destination, not a sub-processor of ours.
Changes to this list
We notify customers before adding a new sub-processor that will process their data, with the opportunity to object as set out in the data processing agreement. This page is the authoritative current list and is updated when the platform changes.
Questions
Sub-processor, security and vendor-review questions: [email protected]. If you need a completed security questionnaire or a due-diligence pack, ask there and we will send one.