1. Current Sub-Processors
| Sub-Processor | Purpose | Location of processing |
|---|---|---|
| Hetzner Online GmbH | Hosting (compute + storage) | Nuremberg, Germany; Helsinki, Finland |
| Cloudflare, Inc. | CDN, DNS, edge TLS, DDoS protection | Global edge network; processing region pinned to EU+US |
| Stripe, Inc. | Tier 2 billing and invoicing | United States; payment data not stored by Operating Co |
| Amazon Web Services - Bedrock | Optional: LLM-enhanced narrative analysis (when enabled) | us-east-1; data not retained by AWS for training |
| Anthropic PBC (via Bedrock) | Claude model invocation under Bedrock | via AWS; no model training on customer data |
| OpenSanctions / Yente | Sanctions and PEP screening data | Berlin, Germany |
2. Updates
This list is updated as Operating Co adds or removes Sub-Processors. Foundations subscribed to the Sub-Processor change feed receive 30 days' advance notice of changes.