Sub-processors
The complete list of third parties that process data on our behalf, as required by GDPR Article 28(2).
This page is the single source of truth. Our Privacy Policy and Data Processing Addendum render the same underlying list, so the three documents cannot drift apart.
The self-hosted boundary comes first
Everything below concerns the HoundShield web application and hosted trial endpoint — the marketing site, your account, billing and the dashboard.
It does not describe self-hosted deployments. When you run the proxy on your own infrastructure (Mode B) or in an isolated network (Mode C), prompt content is scanned locally and never reaches us or any party on this page. That is the deployment mode to use for CUI or PHI. The hosted endpoint is for non-regulated evaluation only, and is not FedRAMP-authorized.
Current sub-processors
| Provider | Purpose | Data | Region |
|---|---|---|---|
| Vercel | Application hosting, edge delivery and build pipeline | account, diagnostics | United States |
| Supabase | Authentication, Postgres database and session storage | account, security | United States |
| Stripe | Payment processing and checkout for the assessment report | account, payment | United States |
| Resend | Transactional email — receipts, password reset, notifications | account, email | United States |
| PostHog | Product analytics. Loaded only after cookie consent is granted. | telemetry | United States |
| Sentry | Error monitoring and stack traces | diagnostics, account | United States |
| Cloudflare | Turnstile CAPTCHA on authentication endpoints | security | Global edge |
| OpenRouter | Routes Brain AI questions to commercial LLM providers. NOT FedRAMP-authorized and NOT covered by a BAA — never submit CUI or PHI to Brain AI. | content | United States |
| Bytez | Model inference endpoint referenced by the application CSP | content | United States |
| Amazon CloudFront | Media delivery for site video assets | diagnostics | Global edge |
Which of these can see the content you type
Most providers above receive only account, billing or diagnostic data. These receive content you submit, and are the ones to check first:
- OpenRouter: Routes Brain AI questions to commercial LLM providers. NOT FedRAMP-authorized and NOT covered by a BAA — never submit CUI or PHI to Brain AI.
- Bytez: Model inference endpoint referenced by the application CSP
Neither is FedRAMP-authorized, and neither is covered by a Business Associate Agreement. Do not submit CUI or PHI to Brain AI or any other AI-assisted feature of the hosted application.
Your own AI providers are not our sub-processors
When the gateway forwards a request to OpenAI, Anthropic or Google, it does so with your API key, at your instruction, to a provider you already have a relationship with. We do not hold that relationship and do not list them here. They belong in your own record of processing activities.
Changes
We will publish any new sub-processor here before it begins processing. To be notified of changes, or to object to a new sub-processor under your DPA, contact legal@houndshield.com.