Overview

CAIRL publishes the current subprocessor list used in our Data Processing Agreement. Providers receive only the data necessary to deliver their scoped service, and CAIRL remains responsible for user-facing privacy and security commitments.

Subprocessor List

Provider	Purpose	Location	Status
Amazon Web Services (AWS)	Cloud infrastructure, identity verification processing (Rekognition, Textract), document storage (S3), serverless compute (Lambda)	United States	Active
Stripe	Payment processing and billing	United States	Active
Vercel	Website hosting and content delivery	United States (global edge)	Active
Mailgun	Email delivery and proxy relay	United States	Active
Google Cloud (reCAPTCHA Enterprise)	Bot protection (score-based) on public forms	United States	Active
Upstash	Rate limiting and session caching	United States	Active
Twilio	Phone verification (OTP delivery)	United States	Active
Plaid	Bank account verification	United States	Active
Anthropic	Support-chat response generation and citation handling when support chat is enabled	United States	Pending; effective August 6, 2026
OpenAI	Support-chat user-query embeddings, knowledge-base embeddings, and fallback response generation when support chat is enabled	United States	Pending; effective August 6, 2026
Slack	Internal support escalation workflow for support-chat transcripts after automated best-effort redaction of common direct identifiers	United States	Pending; effective August 6, 2026

Updates

CAIRL keeps this page synchronized with the Data Processing Agreement subprocessor table. Customers with a signed Data Processing Agreement may receive additional notice rights under that agreement.