[ SUBPROCESSOR REGISTER ]Who else touches your data
The product uses codenames for the reasoning lanes. Transparency does not survive a codename, so this page names every vendor plainly.
[ PENDING REVIEW BY LEGAL COUNSEL ]This text is a best-effort standard draft written by Rizz Group and is pending review by legal counsel. It is not certified legal advice and may change.
Before the table
4SIGHT sends nothing to a vendor that is not needed to produce your report. Reasoning lanes receive the dossier content. Search lanes receive only the name and the search terms. Rendering lanes receive prompts describing imagery, never your files.
The database itself sits in AWS Canada (Central), Montréal, Canada, which is outside the EU. That is stated plainly on the security page rather than dressed up here.
The register
Database, authentication and file storage
- [ DATA RECEIVED ]
- Account email, intake files, generated reports, uploads
- [ PROCESSED IN ]
- AWS Canada (Central), Montréal
- [ RETENTION ]
- Held until erased by the user or by the retention sweep
- [ TRAINS ON YOUR DATA ]
- No, per published terms
- [ PROCESSING AGREEMENT ]
- standard terms accepted
Application hosting and the AI gateway that fronts every model call
- [ DATA RECEIVED ]
- Requests, prompts and model responses in transit
- [ PROCESSED IN ]
- Sweden (company), Cloudflare edge (serving)
- [ RETENTION ]
- Transient; gateway request logs kept short-term for abuse control
- [ TRAINS ON YOUR DATA ]
- No, per published terms
- [ PROCESSING AGREEMENT ]
- standard terms accepted
Anthropic PBC
In-product: THE REASONERNon-EULocation unverified
Primary reasoning model for analysis and drafting
- [ DATA RECEIVED ]
- Dossier content and analysis prompts
- [ PROCESSED IN ]
- United States
- [ RETENTION ]
- Zero-retention / no training on API traffic per published API terms
- [ TRAINS ON YOUR DATA ]
- No, per published terms
- [ PROCESSING AGREEMENT ]
- standard terms accepted
Google LLC (Gemini API)
Non-EULocation unverified
Secondary reasoning model, persona simulation and fallback
- [ DATA RECEIVED ]
- Dossier content and analysis prompts
- [ PROCESSED IN ]
- United States
- [ RETENTION ]
- No training on paid API traffic per published API terms
- [ TRAINS ON YOUR DATA ]
- No, per published terms
- [ PROCESSING AGREEMENT ]
- standard terms accepted
xAI Corp.
Non-EULocation unverified
Live social and public-sentiment reading lane
- [ DATA RECEIVED ]
- Search terms and entity names
- [ PROCESSED IN ]
- United States
- [ RETENTION ]
- Per published API terms
- [ TRAINS ON YOUR DATA ]
- Not confirmed
- [ PROCESSING AGREEMENT ]
- not signed
Perplexity AI, Inc.
Non-EULocation unverified
Live web reading lane
- [ DATA RECEIVED ]
- Search terms and entity names
- [ PROCESSED IN ]
- United States
- [ RETENTION ]
- Per published API terms
- [ TRAINS ON YOUR DATA ]
- Not confirmed
- [ PROCESSING AGREEMENT ]
- not signed
Exa Labs, Inc.
Non-EULocation unverified
Semantic search and source discovery
- [ DATA RECEIVED ]
- Search terms and entity names
- [ PROCESSED IN ]
- United States
- [ RETENTION ]
- Per published API terms
- [ TRAINS ON YOUR DATA ]
- Not confirmed
- [ PROCESSING AGREEMENT ]
- not signed
Supadata
Non-EULocation unverified
Video and podcast transcript retrieval
- [ DATA RECEIVED ]
- Public video URLs supplied in intake or found by the engine
- [ PROCESSED IN ]
- Unconfirmed
- [ RETENTION ]
- Per published API terms
- [ TRAINS ON YOUR DATA ]
- Not confirmed
- [ PROCESSING AGREEMENT ]
- not signed
fal.ai (Features and Labels Inc.)
Non-EULocation unverified
Image and video rendering for report visuals
- [ DATA RECEIVED ]
- Generated prompts describing report imagery; no personal files
- [ PROCESSED IN ]
- United States
- [ RETENTION ]
- Per published API terms
- [ TRAINS ON YOUR DATA ]
- Not confirmed
- [ PROCESSING AGREEMENT ]
- not signed
Transactional email delivery
- [ DATA RECEIVED ]
- Recipient email address, subject line, message body
- [ PROCESSED IN ]
- United States (EU sending region available, not yet enabled)
- [ RETENTION ]
- Delivery logs per vendor default
- [ TRAINS ON YOUR DATA ]
- No, per published terms
- [ PROCESSING AGREEMENT ]
- not signed
Edge serving, TLS termination and denial-of-service protection
- [ DATA RECEIVED ]
- IP address, request metadata
- [ PROCESSED IN ]
- Global edge; EU traffic served from EU points of presence
- [ RETENTION ]
- Short-lived edge logs
- [ TRAINS ON YOUR DATA ]
- No, per published terms
- [ PROCESSING AGREEMENT ]
- standard terms accepted
Historical snapshots of public pages
- [ DATA RECEIVED ]
- Public URLs only
- [ PROCESSED IN ]
- United States
- [ RETENTION ]
- Not applicable, read-only public lookup
- [ TRAINS ON YOUR DATA ]
- No, per published terms
- [ PROCESSING AGREEMENT ]
- not signed
What is not settled yet
Being straight about the gaps matters more than a clean-looking table. As of the review date above:
- Rows marked Location unverified are read off the vendor's public documentation. They have not been confirmed in writing with the vendor.
- Rows marked not signed have no countersigned data processing agreement or standard contractual clauses in place yet. Those are being pursued.
- Where a vendor's training policy is listed as not confirmed, treat it as not confirmed. Do not put anything in an intake that you could not tolerate a US vendor holding.
Changes
This register changes when the engine changes. If a lane is added or a vendor is swapped, the row lands here before the lane goes live for paying accounts.
Last reviewed 2026-08-31 · SIA "RIZZ GROUP", Latvia · legal@rizzgroup.org