Subprocessors

An honest, complete list of the partners we patch in to run the Service.

Each is bound by confidentiality and data-protection obligations, and only receives the data needed for its job. We don’t sell personal information — see the Privacy Policy and DPA. Our OCR and AI models that run on our own infrastructure are not third parties.

Current subprocessors

• Cloudflare

  Hosting, storage, CDN, edge compute, and encryption

  Processes data only to deliver hosting and security; does not sell personal data. SOC 2 Type II and ISO 27001 certified.

  GlobalPrivacy policy ↗

• Google

  Authentication (Sign-in with Google)

  We request only your basic profile and email to sign you in. Subject to Google's privacy policy and API Limited-Use rules.

  United States / GlobalPrivacy policy ↗

• Zoho (ZeptoMail)

  Transactional email

  Sends account emails; Zoho states it does not sell data or use email content for advertising.

  United States / EU / IndiaPrivacy policy ↗

• Stripe

  Payments and billing

  Handles payment details (we never store card numbers). PCI-DSS Level 1; does not sell personal data.

  United States / GlobalPrivacy policy ↗

• Tailscale

  Private networking between processing nodes

  Coordinates an end-to-end-encrypted network; sees connection metadata, never your document traffic. SOC 2 Type II.

  United StatesPrivacy policy ↗

• Anthropic

  AI inference — synthesis & vision

  API inputs and outputs are not used to train models; retained only briefly for trust-and-safety monitoring.

  United StatesPrivacy policy ↗

• OpenAI

  AI inference

  API data is not used to train models by default; retained up to 30 days for abuse monitoring, then deleted.

  United StatesPrivacy policy ↗

• DeepSeek

  AI inference

  API usage is governed by DeepSeek’s Open Platform Terms — you keep your Input rights, and the consumer privacy policy (with its training opt-out) explicitly excludes Open Platform data. Servers are in the People’s Republic of China; there is no explicit no-training guarantee for API inputs.

  People's Republic of ChinaPrivacy policy ↗

• Mistral

  OCR & AI inference

  EU-based and GDPR-aligned; API data is not used for training without your explicit opt-in.

  European Union (France)Privacy policy ↗

Changes

As we optimize the pipeline we may add or swap OCR and vision providers; any new subprocessor is bound by the same confidentiality and data-protection terms before it touches your data. Material changes are reflected by updating the “Last updated” date above. To be notified, contact legal@searchlayerpdf.com.