Subprocessors
AttestLayer may use the providers below to process personal information or customer data only for the listed service purposes. A provider is used only when the applicable feature is enabled. AttestLayer remains responsible for its subprocessor obligations under the Data Processing Addendum.
AI points; it never writes. An AI model (Claude, by Anthropic) only selects sentences that already exist in your records. Every answer is a word-for-word quote, checked by fixed rules and by a second AI check, and nothing reaches your client until you approve it.
Get notified: email privacy@attestlayer.com with "subprocessor updates" in the subject.
| Provider | Purpose | Data categories | Processing locations |
|---|---|---|---|
| Google Cloud Platform | Application hosting, managed compute, database, private object storage, networking, logging, key management, and security. | Account, service, upload, package, and technical metadata. | Canada (Montreal) for primary service resources; limited provider support and security processing may occur in other locations under Google terms. |
| Google Workspace | Business email and correspondence (support@, billing@, privacy@ and security@ mailboxes) | Names, business email addresses and message content you send us | United States and other Google locations under Google Workspace terms |
| Stripe | Provider-hosted checkout, payment, invoice, tax, refund, dispute, and reconciliation services. | Business contact, order, billing, tax, payment status, and payment-method information supplied directly to Stripe. | Canada, United States, and other locations used by Stripe under its data-transfer terms. |
| Twilio SendGrid | Transactional access, order, package, support, privacy, and security email delivery. | Recipient business email, message content, provider message identifier, and delivery, bounce, or complaint events. | United States and other locations used by Twilio under its data-transfer terms. |
| PostHog | Optional, consent-dependent measurement on approved non-sensitive public pages. | Pseudonymous page, consent, device, and campaign metadata; no client request, source record, or package content. | The United States or European Union project selected for the deployment and disclosed through the applicable consent configuration. |
| Cloudflare Turnstile | Abuse and automated-traffic prevention on disclosed public forms. | Request, device, browser, network, challenge, and risk-result metadata. | Global Cloudflare infrastructure under its data-transfer terms. |
| Anthropic, PBC | AI inference (Claude API) to select and check evidence | Excerpts of customer records and questionnaire text; retained up to 30 days and not used for training | United States |
Changes and objections
AttestLayer will publish an intended addition or replacement before it begins processing Customer Personal Data where applicable law or the accepted DPA requires an objection opportunity. An affected customer may send a reasonable, law-based objection to privacy@attestlayer.com. AttestLayer and the customer will work in good faith on a commercially reasonable resolution.
Privacy questions may be sent to privacy@attestlayer.com. See the Privacy Notice and security boundary.