RISOS Subprocessor List

Vercel

Purpose: Application hosting, serverless/edge execution, deployment, and operational request processing.

Data categories: Request metadata and customer/account data processed transiently by RISOS application runtime as needed to serve requests.

Scope: Core application infrastructure.

Supabase

Purpose: Database, authentication, account/workspace persistence, and server-side data services.

Data categories: Account identifiers, workspace records, customer content, research records, settings, and operational metadata stored by RISOS.

Scope: Core data and authentication infrastructure.

OpenAI

Purpose: AI/model processing for research extraction, synthesis, classification, or related functions when the applicable source policy permits the route.

Data categories: Prompts, derived context, and permitted evidence necessary for the requested model-assisted function.

Scope: Model processing; route is policy controlled.

Anthropic

Purpose: AI/model processing and verification where the applicable source policy and configured route permit it.

Data categories: Derived context or permitted evidence necessary for the requested model-assisted function.

Scope: Model processing; route is policy controlled.

xAI

Purpose: AI/model processing for X-permitted or other approved model routes when configured and allowed by source policy.

Data categories: Permitted source evidence or derived context necessary for the approved model-assisted function.

Scope: Conditional model processing; not every research path uses xAI.

Source platforms are different

Google, YouTube, TikTok, X, Bluesky/AT Protocol, Wikimedia, Stack Exchange, GDELT, GitHub, SEC EDGAR, package registries, and other research sources are not classified as subprocessors merely because RISOS retrieves or receives information from them. Their roles depend on the applicable source relationship, platform terms, authorization model, and data flow. Provider-specific obligations are described in the Terms of Service, Privacy Policy, and relevant source-policy controls.

Processing locations and transfers

Subprocessors may operate infrastructure in the United States and other countries according to their service configuration and provider terms. Where Applicable Data Protection Law requires a transfer mechanism, RISOS and the applicable customer relationship will use an appropriate mechanism as described in the DPA. RISOS does not publish a fixed processing-location promise where the verified provider configuration does not support one.

Changes

RISOS updates this page when a third party begins or stops materially processing Customer Personal Data on RISOS’s behalf. Unless a separate written agreement provides a specific advance-notice or objection period, publication of this list does not create one.

Questions about subprocessors can be sent to hello@risos.co.