Current subprocessors
| Name | Purpose | Data categories | Location |
|---|---|---|---|
| Supabase | Postgres database (with pgvector) and authentication for the console | All application data: organizations, member identities (email, name, sign-in provider identifiers), product profiles, submitted documents and their search embeddings, Ask history, triage notes, tasks, API key hashes, webhook and connector configuration, usage and audit events; authentication logs with IP addresses | United States: AWS us-west-2, Oregon (production); us-west-1, California (staging) |
| Render | Hosting for the API, pipeline worker, MCP server, console and scheduled jobs; environment configuration; service logs | All data in transit through the Service; request logs (path, status, latency) without request bodies; secrets held as environment variables | United States: Oregon |
| Anthropic | Language model for classification, summaries, impact assessment, Ask answers and translation | Text of regulatory documents, including documents customers submit; questions and recent conversation turns; product profile names, descriptions and attributes; retrieved passages. No member identities or API keys | United States |
| Sentry | Error monitoring for the API, worker, MCP server and console | Stack traces, request path and method, scrubbed headers, and the page URL for console errors. No request bodies, credentials or cookies; session replay is off | United States |
| Resend | Email delivery: sign-in links, invitations and digests | Recipient email addresses, digest content (signal titles, summaries, impact levels, profile names, console links), sign-in and invitation links | United States |
| Stripe | Subscriptions, invoices and metered billing, when paid plans are enabled for an organization | Billing contact, organization identifier, subscription and invoice records, monthly usage totals, tax identifiers and billing address. Card details are collected directly by Stripe | United States [Confirm Stripe contracting entity and processing locations] |
| Jina | Rendering public publisher pages that block direct fetches | Public URLs of official publishers only. No customer data | Global |
| Exa | Discovering official publishers to add to the source registry | Search queries about publishers. No customer data | United States |
| GitHub | Source code hosting, continuous integration and container registry | Source code and CI logs. No production customer data | United States |
| Google Workspace | Staff accounts and email, including support correspondence | Emails you send to RegSignal staff and their attachments | United States |
What is not on this list
- Embeddings. Search embeddings are computed inside RegSignal's own services on Render with an open-source multilingual model. No embedding provider receives your text.
- Destinations you choose. Your webhook endpoints, Slack workspaces, Microsoft Teams tenants, Jira and ServiceNow instances, and your SAML identity provider are under your control and are not RegSignal subprocessors.
- Public publishers. The regulators and gazettes the pipeline reads receive only our outbound requests, never customer data.
- Web fonts. The site's fonts are bundled and served from RegSignal's own domain, so visitors' browsers do not contact a font provider.
- Optional providers that are off. OpenAI or Voyage (alternative language-model or embedding providers), Browserless (page rendering) and a hosted API gateway control plane become subprocessors only if enabled, and this page would be updated first.
Changes to subprocessors
Before RegSignal adds or replaces a subprocessor that processes Customer Data, we will update this page and notify organization owners [Notice period for subprocessor changes] in advance by [Subprocessor change notification mechanism]. Customers can object on reasonable data protection grounds as described in the Data Processing Addendum.
Each subprocessor is reviewed before use and annually under RegSignal's vendor management policy, and is bound by data protection terms that are no less protective than the Data Processing Addendum. [Confirm that a signed DPA is in place with each vendor listed above.]