Trust · Subprocessors
The services we rely on.
These are the third-party services that may process Customer Personal Information on Inscendo's behalf. Each is contractually obligated to apply protections no less protective than our own Data Processing Addendum. We keep this list current and post material changes here.
| Subprocessor | Role | Region | Category |
|---|---|---|---|
| AI foundation-model provider Inscendo uses a commercial API tier under which the provider is contractually prohibited from using customer data for AI-model training. | Primary AI model provider: processes prompts and generates the agent's responses. | United States | AI |
| AI embedding provider Used under an API tier that does not train on submitted data by default. | Turns text into search vectors that power memory, document search, and conversation search. | United States | AI |
| Microsoft Corporation (Azure) Every customer gets a dedicated database and a per-tenant storage container, with credentials held in a managed, tenant-scoped secrets vault. Logical separation reduces, but does not absolutely eliminate, cross-tenant risk. | Cloud hosting and infrastructure. | United States | Infra |
| Postmark (Wildbit, LLC) Handles platform-generated email; the recipient address is processed only to deliver the message. | Primary transactional and identity email delivery (account, security, and verification emails). | United States | |
| Microsoft Azure Communication Services Backup email path used if the primary provider is unavailable; the recipient address is processed only to deliver the message. | Fallback transactional and identity email delivery. | United States | |
| Stripe, Inc. Inscendo receives tokenized card references only: we never see raw card numbers, expiration dates, or CVVs. | Payment processing for Wallet Funds. Tokenized card storage. | United States | Payments |
| Cloudflare, Inc. Provides authoritative DNS for the domains Inscendo operates. Used and/or reserved to restrict inbound traffic from the EEA, UK, Switzerland, China, Russia, and OFAC-sanctioned regions in support of the U.S.-only eligibility requirement. | Edge networking, authoritative DNS, DDoS protection, and edge-based geographic access controls. | United States | Infra |
| GitHub, Inc. Hosts Inscendo's platform source and build pipelines, not customer configurations, which are stored in each tenant's own per-tenant storage. Does not process Customer application data in the ordinary course. | Source-code hosting and CI/CD for Inscendo's own platform code. | United States | Infra |
| GoDaddy.com, LLC Registrar only: authoritative DNS is provided by Cloudflare. Does not process Customer application data. | Domain registrar. | United States | Infra |
| Backblaze, Inc. Holds an encrypted, write-once copy of each tenant's backups outside Azure so a failure there cannot reach it. Each copy is kept for a fixed period of no more than ninety (90) days and cannot be deleted earlier by anyone, including Inscendo. Listed on August 29, 2026, before any Customer Data is stored with this subprocessor (DPA § 6.3). | Off-site, immutable (write-once) encrypted backup storage of Customer Data and Customer Configurations for disaster recovery. | United States | Backup |
Changes to this list
What changed, and when.
Material changes to the subprocessors above are posted here, as our Data Processing Addendum requires. Newest first.
August 29, 2026
Added Backblaze, Inc. (off-site, immutable encrypted backup storage for disaster recovery; United States). Posted in advance: no Customer Data is stored with Backblaze until this listing has been live. Disclosed in the same change in Data Processing Addendum § 6.2 (version 1.4) and Privacy Policy § 4.1 (version 1.7).