Subprocessor Registry

---

Overview

This page lists the subprocessors that Simply Asking uses to provide our services. A subprocessor is a third-party service provider that processes personal data on our behalf.

Under our Data Processing Agreement (DPA), we commit to:

• Maintaining an up-to-date list of subprocessors
• Providing 30 days advance notice of any changes
• Ensuring all subprocessors meet our security and privacy standards

---

Change Notification

Subscribe to Updates

To receive notifications when we update our subprocessor list, email legal@simplyasking.io with subject "Subscribe to Subprocessor Updates". We will notify subscribers of material changes.

Notification Timeline

• 30 days advance notice for new subprocessors
• 30 days advance notice for significant changes to existing subprocessors
• Immediate notification for emergency replacements (with explanation)

Objection Process

If you object to a new or changed subprocessor:

1. Submit your objection within 14 days of notification
2. Email legal@simplyasking.io with your specific concerns
3. We will work in good faith to address your concerns
4. If we cannot reach resolution, you may terminate affected services

---

Current Subprocessors

Infrastructure & Hosting

AI & Machine Learning

BYOK (Bring Your Own Key): Customers may provide their own API keys for OpenAI, Anthropic, and Google, routing AI processing through their own provider accounts. BYOK keys are encrypted at rest with AES-256-GCM.

Payment Processing

Email & Communication

Monitoring & Error Tracking

Integrations (Optional, Customer-Enabled)

These subprocessors are only used if you enable the corresponding integration:

---

Data Processing Details

Supabase

Purpose: Primary database and backend infrastructure

• PostgreSQL database hosting
• User authentication and session management
• File storage (document uploads)
• Real-time subscriptions

Data Categories:

• Account information (email, hashed passwords)
• Document content and metadata
• Embeddings and search indices
• Activity logs and audit trails

Data Location: United States (us-east-1)

DPA: Supabase DPA

---

OpenAI

Purpose: AI processing for document understanding and chat

• Text embedding generation
• Natural language processing
• Content summarization
• Chat responses

Data Categories:

• Document text (for embedding)
• User queries (for chat)
• Generated responses

Data Retention: Data submitted via API is not used for training. Data sharing for abuse monitoring is disabled for our organization. Zero Data Retention (ZDR) has been requested; until confirmed, standard API data handling applies (retained up to 30 days for abuse monitoring, then deleted).

DPA: OpenAI DPA

---

Google (Gemini API via AI Studio + Google Cloud Document AI / Vision AI)

Purpose: AI processing, document analysis, and OCR

• Entity extraction from documents
• Chat response generation (fallback provider)
• Embedding generation (fallback provider)
• Document AI and Vision AI for OCR / text extraction from images and scanned PDFs

Data Categories:

• Document content
• Chat queries
• Embeddings
• Processing metadata

Data Retention: Paid API tier (AI Studio) — data is not used for model training. No explicit retention window published by Google for paid API tier.

Data Location: United States (us-central1)

DPA: Google Cloud DPA

---

Anthropic

Purpose: Language models for AI processing

• Chat response generation (primary provider for thorough/deep answer modes; fallback for quick mode)
• Entity extraction

Data Categories:

• Chat queries
• Document content (for entity extraction)
• Generated responses

Data Retention: Data submitted via the Anthropic API is not used for model training and is not retained after processing, per Anthropic's API data policy.

Data Location: United States

DPA: Anthropic DPA

---

Cohere

Purpose: Search result reranking

• Scores retrieved document excerpts against the user's query to order search and chat-retrieval results

Data Categories:

• Chat/search queries
• Document excerpts (the retrieved passages being ranked)

Data Retention: Reranking requests are processed transiently to produce relevance scores; no generated content is stored by Simply Asking on Cohere's side. Retention terms are governed by Cohere's SaaS agreement and data-use policy.

Data Location: United States

DPA: Cohere Terms of Use

---

LlamaParse (LlamaIndex)

Purpose: Document parsing and extraction during ingestion

• Parsing of complex PDFs and documents (tables, layouts, scanned content)
• Text extraction for downstream embedding and entity extraction

Data Categories:

• Document content (during processing)

Data Retention: Document content is processed transiently for parsing and is not used for model training.

Data Location: United States

DPA: LlamaIndex Trust Center

---

Stripe

Purpose: Payment and subscription management

• Payment card processing
• Invoice generation
• Subscription management

Data Categories:

• Payment card details (PCI-compliant, we never see full card numbers)
• Billing address
• Transaction history

Data Location: United States

DPA: Stripe DPA

---

Self-Hosted Services (Not Subprocessors)

The following services run on our own infrastructure and do not process data through third parties:

These are listed for transparency. Because they run entirely on infrastructure we control, they are not classified as subprocessors under our DPA.

---

Security Requirements for Subprocessors

All subprocessors must meet the following minimum requirements:

Certifications

• SOC 2 Type II or equivalent
• Regular third-party security audits

Technical Controls

• Encryption in transit (TLS 1.2+)
• Encryption at rest (AES-256)
• Access logging and monitoring
• Multi-factor authentication for admin access

Contractual Requirements

• Data Processing Agreement in place
• Confidentiality obligations
• Security incident notification (within 48 hours)
• Right to audit upon request

Ongoing Monitoring

• Annual security review
• Prompt notification of security incidents
• Regular compliance verification

---

Regional Data Processing

All data is currently processed and stored in the United States. For questions about international data transfers, we maintain Standard Contractual Clauses (SCCs) with applicable subprocessors.

Contact legal@simplyasking.io for questions about international data handling.

---

Change History

2026

Previous Changes

No previous changes (initial version).

---

Questions and Contact

Subprocessor Questions: Email: legal@simplyasking.io

DPA Requests: Email: legal@simplyasking.io

Security Questions: Email: security@simplyasking.io

---

Related Documents

• Data Processing Agreement
• Privacy Policy
• Security Policy
• Terms of Service

---

This subprocessor registry is updated as changes occur. Last review: August 30, 2026