Sub-processors
To deliver the Diligio platform, we engage the third-party sub-processors below. We bind each by written data-protection terms consistent with our Data Processing Agreement, and we remain responsible for their performance. Customer content is never used to train AI models. AI inference runs on providers engaged under zero data retention: Anthropic and Google via their official APIs, and open-source models via OpenRouter.
Effective 06 August 2026
| Sub-processor | Purpose | Location | Data processed |
|---|---|---|---|
Amazon Web Services (AWS) Infrastructure | Primary cloud hosting: compute, object storage (S3), content delivery (CloudFront) and DNS. | European Union (Paris, eu-west-3) | All customer content and account data, encrypted at rest. |
Supabase Infrastructure | Managed PostgreSQL database, authentication and file storage. | European Union (Paris, eu-west-3) | Account data, knowledge-base documents, questionnaire content and compliance records. |
Stytch Infrastructure | Enterprise single sign-on (SSO): brokering SAML 2.0/OIDC authentication with your identity provider. Engaged only for workspaces that enable SSO. | United States | Authentication identifiers for SSO logins (work email, name and the assertion from your identity provider). Used only to establish a session; no questionnaire or knowledge-base content. |
CloudConvert Infrastructure | Document format conversion (e.g. Word and PowerPoint files to PDF) during ingestion. | European Union (Germany) | Office documents you upload for conversion. Processed transiently and not retained beyond the conversion job. |
LlamaParse (LlamaIndex) Infrastructure | Parsing uploaded documents to extract their text and structure during ingestion. | United States | Documents you upload, sent at ingestion time to extract text and structure. Not used to train models. |
Anthropic (Claude) AI | AI inference: drafting and independent verification of answers, and the compliance agent that proposes evidence and control statuses. | United States | Relevant questionnaire, knowledge-base and compliance text sent at inference time via the official Anthropic API, under a zero data retention agreement; not used to train models. |
Google (Gemini API) AI | AI inference and text embeddings for retrieval across Diligio Respond and Diligio Compliance. | United States/Global | Relevant questionnaire, knowledge-base and compliance text sent at inference time via the official Google API, under a zero data retention agreement; not used to train foundational models. |
OpenRouter AI | Routing to open-source AI models for inference across both products. | United States/Global (via third-party model hosts) | Relevant questionnaire, knowledge-base and compliance text sent at inference time, under a zero data retention agreement; not used to train foundational models. |
Resend Email | Transactional email delivery (authentication, invitations, notifications). | United States | Recipient name and work email address. |
Saleshandy Email | Cold-email outreach for prospect marketing (sequencing and delivery). Subscription ends August 2026 and the integration is being retired. | India | Prospect names, work email addresses and outreach content. Not used to train models. |
Upstash Infrastructure | Rate limiting and abuse protection (transient request counters). | Global (region selected at provisioning) | Transient, short-lived request counters derived from IP address. No content. |
Cloudflare Analytics | Cookieless, privacy-friendly web analytics for the public website. | Global (anycast edge network) | No cookies and no personal identifiers. |
Primary cloud hosting: compute, object storage (S3), content delivery (CloudFront) and DNS.
Managed PostgreSQL database, authentication and file storage.
Enterprise single sign-on (SSO): brokering SAML 2.0/OIDC authentication with your identity provider. Engaged only for workspaces that enable SSO.
Document format conversion (e.g. Word and PowerPoint files to PDF) during ingestion.
Parsing uploaded documents to extract their text and structure during ingestion.
AI inference: drafting and independent verification of answers, and the compliance agent that proposes evidence and control statuses.
AI inference and text embeddings for retrieval across Diligio Respond and Diligio Compliance.
Routing to open-source AI models for inference across both products.
Transactional email delivery (authentication, invitations, notifications).
Cold-email outreach for prospect marketing (sequencing and delivery). Subscription ends August 2026 and the integration is being retired.
Rate limiting and abuse protection (transient request counters).
Cookieless, privacy-friendly web analytics for the public website.
Changes & Notifications
We give customers reasonable prior notice before adding or replacing a sub-processor that handles personal data. To subscribe to change notifications, or to raise a reasonable data-protection objection, contact privacy@diligio.co. International transfers are covered by Standard Contractual Clauses and/or the UK International Data Transfer Addendum, as described in our DPA.