Sub-processors
Last updated: 2026-05-06
We engage the following sub-processors to deliver the service. Material changes to this list are communicated to active customers at least 30 days in advance. A formal Data Processing Addendum (DPA) is available on request.
| Sub-processor | Purpose | Location | Data accessed |
|---|---|---|---|
| GovProcurementAI Delivery Team (Bangladesh) | Proposal drafting, compliance review, SSP authoring, analyst support | Bangladesh | Customer documents, solicitation content, profile data (non-CUI engagements only) |
| OpenAI | Large language model inference for proposal drafting and analysis agents | United States | Prompts and retrieved context as required for inference; no cross-customer training |
| Stripe | Retainer billing, contingency invoicing, vendor payouts | United States | Billing contact information, invoice metadata |
| Clerk | Authentication, identity, multi-factor enforcement | United States | User authentication credentials and session metadata |
| Amazon Web Services | Application hosting, document storage, database, backups | United States (us-east region) | All customer data at rest and in processing |
| Sentry | Application error monitoring | United States | Error stack traces and limited request metadata |
| PostHog | Product analytics | United States | Product usage events; PII redacted at the source |
CUI scope policy: the Bangladesh delivery team handles non-CUI engagements only. Engagements requiring direct CUI handling are referred to a US-citizen partner firm. The CMMC readiness software product remains available regardless of CUI scope.
Questions about sub-processors or to request the DPA: [email protected].