Subprocessors
The third parties that process customer data on RegPermit's behalf, what each one receives, and where it is processed.
| Subprocessor | Purpose | Customer data received | Processing location |
|---|---|---|---|
| Amazon Web Services, Inc. | Cloud infrastructure for the production environment: compute, managed database, document storage, key management, logging, customer identity and sign-in, and model inference. | As the host of the production environment, all customer content, account data and service logs. Through the inference service, prompt text and the content of documents the assistant reads or writes. | United States |
| Cloudflare, Inc. | Edge network, DNS, public TLS termination and the tunnel through which the application is published, together with protection against network-level abuse. | Public TLS terminates here, so every request and response passes through in decrypted form at the edge: uploads, downloads and assistant conversations, with IP addresses, session tokens and request metadata. | Global, served from the point of presence nearest the user |
| Stripe, Inc. | Payment processing and subscription billing. | Billing contact name and email address, the account identifier, and subscription, usage, invoice and payment records. Card details are collected by Stripe directly and are never received by RegPermit. | United States and global |
| Resend (Plus Five Five, Inc.) | Transactional email delivery: team invitations, billing notices, and account and security notices. | Recipient address, sender, subject and message content, together with delivery events such as delivered, bounced or rejected. | United States |
Changes to this list
RegPermit gives at least 30 days' notice before a new subprocessor begins processing customer data, so that a customer has time to object. Notice is given by email to the account owner and by an update to this page. Where a subprocessor has to be replaced urgently to keep the service running or to address a security risk, notice is given within five business days of the change.
Model providers
Model inference runs on Amazon Bedrock, a service of the hosting provider reached over the network. No separate model company receives customer content. AWS states that inputs to and outputs from that service are not stored, are not shared with model providers, and are not used to train any model.
Asking about this list
A fuller version of this list, naming the assurance report held for each subprocessor and the period it covers, is available on request. Write to [email protected].