Subprocessors

RiskForesight uses the third-party subprocessors below to provide the service. Each is engaged under a data-protection agreement and, where personal data is transferred outside the EEA/UK, appropriate safeguards (such as the EU Standard Contractual Clauses and the UK Addendum). This list is referenced by our Privacy Policy.

Infrastructure & platform

• Supabase — primary database, authentication, and file storage (tenant data at rest). Processing in the European Union (London).
• Vercel — application hosting and edge/CDN delivery. Global edge; primary compute per region.
• Fly.io — asynchronous Monte-Carlo / compute worker. European Union (London).

Payments

• Paddle — Merchant of Record: payment processing, invoicing, and tax. Acts as an independent controller for payment data. Global.

Communications

• Resend — transactional and (opt-out) marketing email delivery. United States / European Union.

AI providers

• Anthropic — AI features (Claude models), bound by terms prohibiting training on customer data. United States.
• OpenAI — AI features (optional models), bound by terms prohibiting training on customer data. United States.

Personal data is redacted before transmission to AI providers where configured. We do not use customer data to train foundation models.

Analytics

• PostHog — product analytics and session replay (consent-based; sensitive inputs masked in recordings). European Union.

Security & operations

• Sentry — application error monitoring. United States / European Union.
• Cloudflare — bot-protection challenge (Turnstile) at sign-in. Global.

Changes to this list

We may update our subprocessors as the service evolves. Where a new subprocessor will process personal data, we will update this page and, for customers who have subscribed to notifications or entered into a Data Processing Addendum, provide advance notice with an opportunity to object on reasonable data-protection grounds. To be notified of changes, contact privacy@riskforesight.app.