This is the Subprocessor List named in the DPA Details of our Data Processing Addendum, which incorporates the Bonterms Data Protection Addendum v2.0. It lists the third parties ElasticD3M, LLC authorizes to process Customer Personal Data for Enclave AI™, with each one's function and location, as Section 4.2 of that form requires. It was built from the services the running product calls, not from a dependency list.
Active Subprocessors
| Subprocessor | Function | Data Scope | Location |
|---|---|---|---|
| Railway (Railway Corp.) | Application hosting and the production database for the backend service | All Customer Data the Cloud Service holds, in transit and at rest | United States regions |
| Stripe, Inc. | Payment processing, billing portal and invoices for one-time purchases and subscriptions | Billing identity, payment method (Stripe stores card data; we receive only metadata) | United States |
| Resend | Transactional email delivery (welcome emails, deliverable notifications, results emails, operator alerts) | Identity / contact information, email message contents and attachments | United States |
| Anthropic, PBC | Large language model inference for document generation (Claude API) | Configuration metadata, intake responses, and the attestations and asset inventory Customer records, passed as model input; outputs are deliverable contents (drafts of SSP sections, POA&M items, prime questionnaire answers, and the Level 2 Readiness Snapshot analysis when no cloud is connected) | Data at rest: United States. Model inference: United States. Every request the Cloud Service sends asks Anthropic for U.S.-only inference, and each response's reported inference location is recorded. |
| Cloudflare, Inc. | DNS, content delivery and hosting for ai4cmmc.ai, the edge function that relays the free gap check's email request to our backend, web analytics, and access control for the operator console | Technical metadata (IP address, user agent, request paths); the email address and answers a visitor submits to the free gap check, relayed to our backend | Global edge network (requests are served from the location nearest the visitor) |
| Google Workspace (Google LLC) | Domain email hosting and routing for ai4cmmc.ai correspondence (hello@) | Email content from Customer correspondence with ElasticD3M, LLC | Google data centers; no Workspace data-region setting is relied on, so storage may be outside the United States |
| Functional Software, Inc. (Sentry) | Application error and exception monitoring for the backend service | Technical diagnostics only: exception type, stack trace, endpoint name, release and environment. Automatic PII collection is disabled, request bodies are never transmitted, and request URLs, query strings and identifiers are redacted before an event is sent. Performance tracing is off. | United States (Sentry US data region) |
What is not a Subprocessor
- The services Customer connects (AWS, Azure, Microsoft 365, Google Workspace, Okta, CrowdStrike) are Customer's Third-Party Platforms under Section 8 of the Bonterms Standard Online Cloud Terms. The Cloud Service reads configuration metadata from them through read-only access Customer grants; it does not store Customer Data in them.
- Public data feeds, such as the CISA Known Exploited Vulnerabilities catalog, are downloaded; no Customer Data is sent to them.
Changes and Objections
Under Sections 4.3 and 4.4 of the Bonterms Data Protection Addendum, at least 30 days before a new Subprocessor processes any Customer Personal Data, we add it to this list and notify Customer by email to the account's primary contact. Customer may object in writing within 30 days after that notice, and the parties will discuss the concern in good faith; if it is not resolved, Customer's remedy is to terminate the affected portion of the Cloud Service and receive a refund of prepaid, unused fees for it. Section 4.1 of that form requires a written agreement with each Subprocessor imposing data protection obligations substantially the same as the DPA's, and keeps us liable for each Subprocessor's acts and omissions under the DPA.
Contact
Subprocessor questions or objections: privacy@elasticd3m.com
Last Updated: September 24, 2026 · Version: 3.0