This document is pending review by legal counsel and may change. If you need a signed version or have questions, email support@compliancegrid.ai.
These are the third parties that process customer data on our behalf. The Data Processing Addendum applies to them. Where a request can be handled without a language model, set aiMode: "off" on the request, or turn AI off for your whole account in the developer portal, and the two AI providers below receive nothing.
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Microsoft Azure | Hosting and storage: application compute (Azure Container Apps), PostgreSQL database, container registry, blob storage, logs | All customer data held by the service: account records, screening records, request logs (with personal identifiers redacted), webhook configuration (secrets encrypted) | United States. Compute in East US; PostgreSQL in Central US. Azure commercial cloud, not Azure Government |
| Clerk | User authentication for the website and developer dashboard | Name, email address, sign-in method and session data of dashboard users | United States |
| Stripe | Billing and payments | Billing contact, payment details (held by Stripe, not by us) and usage totals | United States |
| Anthropic | Large language model for risk scoring narratives, adverse-media analysis, AI-assisted HS classification, smart tariff advisories and the AI chat assistant | Party names, aliases, country and summaries of public records found about them; commodity descriptions and tariff calculation inputs. Date of birth, SSN digits, passport and national ID numbers are never sent. Not used when aiMode is off | United States |
| Resend (Plus Five Five, Inc.) | Sending account, notification, billing and sales-inquiry emails, and alerts to our own staff about filings waiting for them | Recipient email address and message content: names, verification codes, credit-balance notices, and, in staff alerts, the exporter's name and EIN and the shipment's mode and export date | United States. Resend stores message content and delivery logs in the United States whatever sending region is used. Resend's own subprocessors are listed at resend.com/legal/subprocessors |
AI providers: retention and training
Under the standard API terms of both AI providers, data sent through their APIs is not used to train their models. Both providers may retain API inputs and outputs for a limited period (up to 30 days) for abuse monitoring. Zero data retention is a separate arrangement that must be approved by the provider; it is not enabled on our accounts today. If you cannot accept provider-side retention, use aiMode: "off". We will update this page if that changes.
Public data sources we query
To answer some requests we query public government and data services. These are data sources, not subprocessors, but they do receive search terms derived from your request:
| Service | What it receives |
|---|---|
| trade.gov (Consolidated Screening List) | Nothing about your queries: the full list is downloaded and matching happens on our systems |
| data.transportation.gov (FMCSA) | USDOT numbers and carrier-name search terms |
| GDELT Project | Entity names used as adverse-media search terms (risk scoring; not used when the data is unavailable) |
| SEC EDGAR, FDIC, openFDA and other public APIs | Search terms such as company names or identifiers for the lookup you requested |
Changes
We update this page when we add or replace a subprocessor. Questions: support@compliancegrid.ai.