Subprocessors
Last updated: July 10, 2026
Effective: July 28, 2026
This page lists subprocessors used by Triqai to provide the Services. We update this page when subprocessors materially change.
For enterprise customers, subprocessor governance and notification terms are described in our DPA.
1. How We Use Subprocessors
Triqai engages subprocessors for specific functions such as infrastructure, hosting, databases, observability, billing, email delivery, anti-abuse, analytics, and enrichment support services.
1.1 Infrastructure, Hosting, and Platform Services
| Subprocessor | Purpose | Primary Processing Location(s) | Transfer Safeguards |
|---|---|---|---|
| Cloudflare | Core API runtime and infrastructure, edge security, DNS, and analytics support | EU and global (service-dependent) | SCCs or equivalent safeguards where required |
| Vercel | Marketing/dashboard web hosting, edge delivery, and scheduled web cron execution | EU/US/global (service-dependent) | SCCs or equivalent safeguards where required |
| Neon | Managed PostgreSQL database infrastructure for application data storage | EU | SCCs or equivalent safeguards where required |
1.2 Billing, Email, and Operational Services
| Subprocessor | Purpose | Primary Processing Location(s) | Transfer Safeguards |
|---|---|---|---|
| Stripe | Payments, subscription management, and invoicing | EU/US/global (service-dependent) | SCCs or equivalent safeguards where required |
| Resend | Transactional and service email delivery (verification, password reset, policy notifications) | US (service-dependent) | SCCs or equivalent safeguards where required |
1.3 Security, Monitoring, and Analytics
| Subprocessor | Purpose | Primary Processing Location(s) | Transfer Safeguards |
|---|---|---|---|
| Upstash | Rate limiting and security-related key-value operations | EU/US/global (service-dependent) | SCCs or equivalent safeguards where required |
| Sentry | Error monitoring and incident diagnostics (configured to minimize personal data) | EU/US/global (service-dependent) | SCCs or equivalent safeguards where required |
| Umami Cloud | Privacy-oriented marketing-site analytics | EU/US/global (service-dependent) | SCCs or equivalent safeguards where required |
| Cloudflare Turnstile | Bot detection and abuse prevention on public forms/endpoints | EU and global (service-dependent) | SCCs or equivalent safeguards where required |
1.4 AI Inference Providers
Triqai uses multiple OpenAI-compatible AI inference providers for enrichment pipelines. Normalized transaction text is sent after minimization and redaction. Amounts, dates, account data, and organization identifiers are removed. Because transaction descriptions are unstructured, remaining text may still contain personal data, such as a person name in a peer-to-peer payment.
| Subprocessor | Purpose | Primary Processing Location(s) | Transfer Safeguards |
|---|---|---|---|
| Groq | Primary AI inference for transaction enrichment | US (provider-dependent) | SCCs or equivalent safeguards where required |
| Cerebras | Secondary AI inference for transaction enrichment (fallback) | US (provider-dependent) | SCCs or equivalent safeguards where required |
| Mistral | AI inference for transaction enrichment (fallback) | EU/US (provider-dependent) | SCCs or equivalent safeguards where required |
| DeepInfra | High-capacity AI inference for transaction enrichment (fallback) | US/EU (provider-dependent) | SCCs or equivalent safeguards where required |
1.5 Web Search and Data Enrichment Providers
Web search providers receive merchant or location query terms and country codes, not the original raw transaction description, amounts, account data, or organization context. Query terms may constitute personal data in uncommon cases, such as a sole trader name.
| Subprocessor | Purpose | Primary Processing Location(s) | Transfer Safeguards |
|---|---|---|---|
| Serper | Primary web search for merchant/location enrichment | US (service-dependent) | SCCs or equivalent safeguards where required |
| Autom | Secondary web and places search for merchant/location enrichment (fallback) | US (service-dependent) | SCCs or equivalent safeguards where required |
| Exa | Optional web search for enrichment (disabled by default; enabled per configuration) | US (service-dependent) | SCCs or equivalent safeguards where required |
| UK Companies House API | Public registry lookups for UK company context enrichment | United Kingdom | Not a transfer mechanism provider; public registry data source usage |
2. Subprocessor Change Notifications
Material subprocessor additions or replacements are notified under the process defined in the DPA, including notice period and objection handling for customers with applicable contractual rights.
Notification is provided through account-owner email and/or designated contractual contacts, with dashboard or website updates as supplemental notice channels. Policy update emails include a unique notification reference for tracking and compliance purposes.
3. Other Third-Party Recipients
Some integrations (for example optional Google or GitHub social login selected by the user) may involve third parties acting as independent controllers for their own processing activities under their own privacy notices.
4. Data Minimization Applied to Subprocessors
Before sharing data with subprocessors, Triqai applies the following minimization controls:
- AI inference providers receive normalized transaction text after minimization and redaction. Reference numbers, card fragments, account-like tokens, amounts, dates, and organization identifiers are removed before transmission. Unstructured text may still contain personal data.
- Web search providers receive merchant or location query terms and country codes, not the original raw transaction description, amounts, account data, or organization context. Query terms may constitute personal data in uncommon cases.
- Error monitoring is configured to minimize personal data in error reports.
- Analytics is configured to minimize personal data collection and does not use advertising profiling or cross-site behavioral targeting.
5. Questions
For subprocessor questions, contact support@triqai.com.