Legal
Subprocessors
Effective 5 September 2026 · Chainsilience AI
01What a subprocessor is
A subprocessor is a company we engage that may process personal data or your workspace content in the course of providing part of our service — hosting it, computing on it, or delivering a message about it. They act on our instructions, under contract, for the purpose named below and nothing else.
02The current list
| Provider | What it does for us | What it receives | Primary location |
|---|---|---|---|
| Render | Runs the API and hosts the primary database | All platform data at rest: accounts, company profiles, digital twins, risks, actions, drafts and feedback | United States |
| Vercel | Hosts and serves the web application | HTTP request metadata, including IP address and user agent. No workspace content is stored here | United States and global edge network |
| NVIDIA | Nemotron inference — risk scoring, reasoning, event extraction | The disruption event and the relevant slice of your supply-chain model: supplier and site names, locations, countries and dependency attributes | United States |
| OpenAI | Fallback inference when NVIDIA is unavailable or unconfigured | The same context as above | United States |
| Stripe | Takes payment and manages subscriptions | Your name, email, billing address and card details, which you give to Stripe directly. We receive only customer and subscription identifiers back | United States and global |
| Google (Gmail SMTP) | Delivers transactional email — sign-up codes and password-reset links | The recipient's email address and the contents of that message | United States and global |
| Calendly | Scheduling widget on our public website only | Whatever you enter when booking a call, plus the cookies Calendly sets in your browser. It is not loaded inside the platform | United States |
03Only when enabled
Two entries above are conditional on configuration, and we would rather list them than have you discover them later:
- Inference providers. Requests go to NVIDIA where it is configured, and otherwise to OpenAI. If neither is reachable, a deterministic scorer runs on our own servers and no supply-chain context leaves them at all.
- Neo4j Aura. Where a deployment enables the graph store, your supply-chain nodes and relationships are mirrored into a managed Neo4j database, one subgraph per company, for dependency-path queries. Where it is not enabled, the relational database on Render remains the only store.
04News sources are not subprocessors
The platform reads roughly twenty public RSS feeds — general and business outlets alongside shipping and logistics trade press. We fetch from them; we send them nothing about you. They receive an ordinary HTTP request from our servers and no customer data whatsoever, so they are sources rather than subprocessors.
05How we choose them
Before we engage a subprocessor we check that it:
- is contractually bound to protect the data and to use it only for our instructions;
- offers an appropriate transfer mechanism for personal data leaving the UK, the EEA or another restricted region;
- does not claim a right to train models on, mine, or otherwise repurpose what we send it;
- is actually necessary — the shortest list we can operate on is the goal.
06Notice of changes
We will update this page and its effective date whenever the list changes, and we will email account administrators at least 30 days before a new subprocessor begins processing personal data — so there is time to object.
If you object on reasonable data-protection grounds, tell us at chainsilienceai@gmail.com. We will try to offer an alternative; if we cannot, you may terminate the affected part of the service and we will refund any fees you have paid for a period you will not receive.