Last updated: October 3, 2026
A sub-processor is a third party we engage to process Customer Content on our behalf. We are responsible under our Data Processing Agreement for ensuring that each sub-processor provides protection for Customer Content consistent with our DPA.
Change notifications. We will announce material changes to this list — new AI Providers, new regions, or new categories of sub-processor — at least 30 days before the change takes effect, to the email address of your account administrator. You can object to a new sub-processor within 30 days by emailing legal@sureciteai.com; if we cannot reasonably accommodate your objection, your remedy is to terminate the Service for the affected data.
No training on Customer Content. The two AI Providers we call directly, Cohere and Voyage AI, do so for search reranking under API terms that exclude training on the data we send. Every model request goes through OpenRouter, and each request limits OpenRouter's choice to hosts that, as OpenRouter records them, neither train on prompts nor keep them (OpenRouter's zdr and data_collection: deny settings). The limit also applies to hosts OpenRouter adds after this page was last updated; the table below lists the hosts that met it on October 3, 2026. Text extraction from scanned PDFs and images is further restricted in the request to Google Vertex AI.
Retention. Model hosts reached through OpenRouter keep no prompts. Three sub-processors do keep Customer Content: Pinecone stores document chunks for search until you delete the document, and Cohere and Voyage AI keep reranking requests under their own published terms.
Infrastructure
Infrastructure sub-processors: vendor name, purpose, data processed, region, and link to their data processing agreement.| Sub-processor | Purpose | Data processed | Region | DPA |
|---|
| Vercel, Inc. | Web application hosting, serverless compute, CDN, and AI Gateway (forwards embedding requests to OpenAI when enabled). | Request metadata, session tokens, Customer Content in transit. | United States (global edge). | View |
| Supabase, Inc. | Managed PostgreSQL database, object storage, row-level security enforcement. | Account data, workspace metadata, encrypted Customer Content. | United States (primary). EU region on Scale, Enterprise, and Custom plans. | View |
| Vercel Blob (Vercel, Inc.) | Document storage. | Uploaded files (encrypted at rest with AES-256 by Vercel). | United States. | View |
| Pinecone Systems, Inc. | Vector database for document search. Each workspace has its own namespace. | Embeddings and keyword vectors of document chunks, the chunk text, filename, page number, and document and workspace identifiers. | United States (AWS us-east-1). | View |
Authentication
Authentication sub-processors: vendor name, purpose, data processed, region, and link to their data processing agreement.| Sub-processor | Purpose | Data processed | Region | DPA |
|---|
| Clerk, Inc. | User authentication, session management, and multi-factor authentication. | Email, name, authentication tokens, device metadata. | United States. | View |
AI Provider
AI Provider sub-processors: vendor name, purpose, data processed, region, and link to their data processing agreement.| Sub-processor | Purpose | Data processed | Region | DPA |
|---|
| OpenRouter, Inc. | Routes every model request: answers, question classification and rewriting, follow-up suggestions, search expansion, document summaries, text extraction from scanned PDFs and images, and embeddings for search. Forwards each request only to a host listed under "Model hosts reached through OpenRouter" below. | Questions, conversation context, relevant document excerpts, document chunks (for embeddings), up to the first 3,000 characters of each uploaded document (for its summary), and scanned PDF pages and images (for text extraction). | United States. Model hosts: see below. | View |
| Cohere Inc. | Search-result reranking on Enterprise and Custom plans (Rerank 3.5, called directly). | The question and the document excerpts retrieved for it. | United States and Canada. | View |
| Voyage AI (MongoDB, Inc.) | Search-result reranking on Solo, Team, Business, and Scale plans (rerank-2.5-lite, called directly). | The question and the document excerpts retrieved for it. | United States. | View |
Payments
Payments sub-processors: vendor name, purpose, data processed, region, and link to their data processing agreement.| Sub-processor | Purpose | Data processed | Region | DPA |
|---|
| Stripe, Inc. | Subscription billing and payment processing. | Billing contact, card details (held by Stripe, not SureCiteAI), invoice history. | United States, Ireland. | View |
Email
Email sub-processors: vendor name, purpose, data processed, region, and link to their data processing agreement.| Sub-processor | Purpose | Data processed | Region | DPA |
|---|
| Resend, Inc. | Transactional email (account, billing, security notifications). | Email address, message content (templated transactional notifications). | United States. | View |
Analytics
Analytics sub-processors: vendor name, purpose, data processed, region, and link to their data processing agreement.| Sub-processor | Purpose | Data processed | Region | DPA |
|---|
| Vercel Analytics (Vercel, Inc.) | Aggregate product usage analytics (no cross-site tracking). | Page views, aggregate usage metrics. No Customer Content. | United States. | View |
Model hosts reached through OpenRouter
OpenRouter forwards each request to one of several hosts that serve the requested model, choosing by price, speed, and availability. These are the models we send through OpenRouter, and the hosts OpenRouter listed on October 3, 2026 as serving them without keeping or training on prompts. Our requests reach no other host: OpenAI, Anthropic, Cloudflare, Cohere and Google AI Studio also serve some of these models but keep prompts, so they are excluded.
Models sent through OpenRouter and what each is used for.| Model | Used for |
|---|
| qwen/qwen-2.5-7b-instruct | Answers to simple questions; query rewriting; follow-up suggestions; onboarding persona; fallback for answers to standard questions, answers to complex questions |
| meta-llama/llama-3.3-70b-instruct | Answers to standard questions; answers to complex questions; fallback for premium add-on answers |
| anthropic/claude-sonnet-4.5 | Premium add-on answers |
| meta-llama/llama-3.1-8b-instruct | Question classification; fallback for answers to simple questions, answers to standard questions, answers to complex questions, query rewriting, follow-up suggestions, onboarding persona |
| bytedance-seed/seed-1.6-flash | Search expansion (a hypothetical answer used only for retrieval) |
| openai/gpt-4o-mini | Document summaries at upload |
| google/gemini-3.1-flash-lite | Text extraction from scanned PDFs and images at upload (Google Vertex AI only) |
| openai/text-embedding-3-small | Embeddings of document chunks and questions for search |
| openai/gpt-4o | Fallback for premium add-on answers |
Hosts OpenRouter can route our requests to: models served, whether the host trains on prompts, prompt retention, and location.| Host | Models | Trains on prompts | Keeps prompts | Location |
|---|
| DeepInfra | Llama 3.3 70B, Llama 3.1 8B | No | Not kept | United States |
| Novita | Llama 3.3 70B, Llama 3.1 8B | No | Not kept | United States |
| Groq | Llama 3.3 70B, Llama 3.1 8B | No | Not kept | United States |
| CoreWeave | Llama 3.3 70B, Llama 3.1 8B | No | Not kept | United States |
| Parasail | Llama 3.3 70B | No | Not kept | United States |
| SambaNova | Llama 3.3 70B | No | Not kept | United States |
| Together | Llama 3.3 70B | No | Not kept | United States |
| AkashML | Llama 3.3 70B | No | Not kept | Not published (decentralised GPU network) |
| Google Vertex AI | Llama 3.3 70B, Claude Sonnet 4.5, Gemini 3.1 Flash Lite | No | Not kept | United States (us-central1, us-east5), EU multi-region, and global endpoints |
| Phala | Qwen 2.5 7B | No | Not kept | United States |
| Seed (ByteDance / BytePlus) | Seed 1.6 Flash | No | Not kept | Singapore |
| Microsoft Azure | GPT-4o, GPT-4o mini, text-embedding-3-small | No | Not kept | United States, Sweden (swedencentral), and global endpoints |
| Amazon Bedrock | Claude Sonnet 4.5 | No | Not kept | United States, Ireland (eu-west-1) |
Subscribe to change notifications
To receive email notice when this list changes, send an email to legal@sureciteai.com with the subject "Subprocessor notifications" and the account email you'd like subscribed.
