Schedule 2: Sub-processors

Sub-processor entity	Brief description of processing	Selected locations of data center(s)	Certifications / attestations
Convex, Inc. (USA)	Hosting of the Tool backend and database, application runtime, authentication	EEA – Ireland. Safeguard for any remote access: [SCCs / EU-US DPF – per Convex DPA]	SOC 2 Type II; HIPAA (BAA available). Runs on AWS (ISO/IEC 27001, SOC 2 Type II).
Cloudflare, Inc. (USA)	Storage of submitted files (R2, EU jurisdiction); delivery of the web application (CDN, no Customer Data stored at the edge)	EEA (storage); global edge network (web application delivery). Safeguard: EU-US DPF + SCCs	ISO/IEC 27001:2022, ISO/IEC 27018, ISO/IEC 27701; SOC 2 Type II; PCI DSS; C5.
OpenRouter, Inc. (USA)	AI inference routing with EU in-region routing, zero data retention, no training on Customer Data	EEA. Safeguard for any remote access: [per OpenRouter DPA – pending]	SOC 2 Type II.
Google Cloud EMEA Limited (Ireland)Vertex AI, engaged via OpenRouter	AI model inference	EEA	ISO/IEC 27001, 27017, 27018, 27701; ISO/IEC 42001 (AI management); SOC 1/2/3; C5.
Functional Software, Inc. d/b/a Sentry (USA)	Application error monitoring (pseudonymous user ID, organisation ID; no submitted content)	EEA – Germany. Safeguard: EU-US DPF + SCCs	SOC 2 Type II; ISO/IEC 27001; HIPAA attestation.
Plus Five Five, Inc. d/b/a Resend (USA)	Transactional e-mails (login, invitations, password reset): name, e-mail address, organisation name	USA. Safeguard: EU-US DPF	SOC 2 Type II.
Deepgram, Inc. (USA)	Speech-to-text transcription – only where the Customer uses audio submissions	EEA (EU endpoint). Safeguard: [per Deepgram DPA]	SOC 2 Type II; HIPAA (BAA available).
Mistral AI SAS (France)	AI model inference and speech-to-text transcription – only where a Mistral model is selected for the Customer; no training on Customer Data	EEA (EU endpoint). Safeguard for any onward transfer: SCCs (Mistral DPA)	SOC 2 Type II; ISO/IEC 27001, ISO/IEC 27701.