Subprocessors

Who else sees your data, and exactly what they see

This page lists every third party that processes data you put into Complipath, and for each one what it actually sees. A subprocessor list that names the vendor and leaves the scope to be assumed is not useful to the person reading it before a purchase — the assumption is always wrong in one direction or the other.

Every row below names the party, what it is used for, and WHICH FIELDS REACH IT. Where we have not read a provider's own terms on a point, the row says unread rather than guessing. Each row carries the date it was read and the date it is to be read again.

Where a row says nothing about training, retention or region, that is because we have not read the term ourselves — not because there is none.

Where a language model sits, and where it does not

No language model is in the decision path. The classification engine takes your answers and nothing else — classify(answers: Answers) is its whole input — and a test in the application repository forbids every engine file from importing a database client or an observation module. That guard is a source scan, not a proof by execution: it verifies that no engine file imports those things, and the execution-level fact is carried by the type. Anchored in the application repository at commit 784a885, read 2026-08-18.

And a model does read what you give it, on the paths named in the Anthropic row below. The clearest one is the check's optional reading step: the domain you typed and the text of the public pages it fetched are sent to Anthropic's API. Your answers to the classification questions are never in that payload, because they never leave your browser. This paragraph does not list the paths itself — the row does, generated from the code rather than written twice. We have not read Anthropic's API retention terms; until someone does and records what they read, this page says so instead of guessing.

Either sentence alone is a false picture of the same system. The first without the second is a claim that no model touches anything, which the reading step contradicts; the second without the first invites the reader to assume a model decides the verdict, which it does not.

Who processes what

Most seen first.

Supabase (Supabase Inc.)

Postgres database, authentication and file storage.

What they see

users.email, users.name, users.role
ai_systems.name, .purpose_use_case, .business_owner, .technical_owner, .type, .domain, .status, .github_repo_link
risk_assessments.answers, .factors, .reasoning, .primary_citation, .risk_level, .confirmed_by, .contest_note, .question_wording
obligations.owner, .evidence_link, .notes, .status
doc_sections.body, .confirmed_by
article_6_3_claims.reasoning, .recorded_by
ai_literacy_records.person, .activity, .material, .evidence_link
review_notes.body, .author_id
activity_log.verb, .actor_id, .citation
organizations.name, .plan, .billing_state, .settings, .profile
every other column of the 28 tables in the schema

What they do not see

card numbers — the payment form is Stripe's own and never posts to us

Where it says so in the code

lib/supabase/server.ts, lib/supabase/admin.ts (commit d77c6f7)
supabase/migrations/ — the whole schema (commit d77c6f7)

Read 2026-08-23 by Claude (this session), from supabase/migrations/, lib/supabase/ at commit d77c6f7; project ref lfkviwccptstavpcjsho, region eu-central-1, read from the Supabase MCP project settings. To be read again by 2026-11-23.

Resend (Resend, Inc.)

Delivering the sign-in link, the periodic snapshot, the corpus-change letter and feedback notes.

What they see

users.email as the recipient of every message
the sign-in link, which is a one-time token for that address
snapshot — organizations.name and the letter's counts; and ai_systems.name where a legal update affects exactly one system, because the impact label then reads "Affects <name>"
corpus letter — organizations.name and ai_systems.name for each system whose cited provisions moved
feedback notes — organizations.name, ai_systems.name, the note she typed and the reply address she gave

What they do not see

assessments, obligations, documentation or the activity log
who wrote a feedback note: that column does not exist

Where it says so in the code

app/api/snapshot/route.ts, lib/email/snapshot.ts (commit d77c6f7)
app/api/corpus-watch/route.ts, lib/corpus-watch.ts (commit d77c6f7)
lib/feedback-delivery.ts (commit d77c6f7)
Supabase Auth SMTP — the sign-in template, a dashboard setting no code here can read

Read 2026-08-23 by Claude (this session), from lib/email/snapshot.ts, lib/corpus-watch.ts, lib/feedback-delivery.ts, lib/market-law.ts at commit d77c6f7. To be read again by 2026-11-23.

Vercel (Vercel Inc.)

Hosting, serverless functions and the platform log.

What they see

the request URL of every page, which contains ai_systems.id in every /systems/<uuid>/… path
the caller's IP address and user agent, as request metadata
the request body of every form submission and server action — the same fields Supabase receives
our own log lines: stripe_webhook <outcome>, stripe_webhook billing:<state>:<reason>, stripe_webhook plan_unchanged:<reason>, stripe_webhook money_back:<event>, stripe_webhook write_failed <message>, and the check-read fallback reason code

What they do not see

a domain, a system name or a page excerpt in any log line we write — the check-read guard pins the log statement character-for-character and requires a bare literal at every call site

Where it says so in the code

app/api/stripe-webhook/route.ts, lib/check-read/reason.ts (commit d77c6f7)
middleware.ts — every matched route (commit d77c6f7)

Read 2026-08-23 by Claude (this session), from a sweep of every console.* call in app/ and lib/ at commit d77c6f7; vercel.json pins functions to fra1. To be read again by 2026-11-23.

Anthropic (Anthropic PBC)

Three model calls: reading a company's public pages in the public classifier, suggesting answers from a description she types, and drafting documentation paragraphs.

What they see

public classifier — the domain a visitor submits, and the extracted text of the public pages fetched from it
answer suggestions — the free-text description she types into the assess page, and nothing else from the register
documentation drafting — ai_systems.name, .purpose_use_case, .status, .business_owner, .technical_owner, .type, .domain, plus every stored engine answer in risk_assessments.answers, rendered

What they do not see

any part of the register in the public classifier — it runs before an account exists
obligations, doc_sections, review_notes or activity_log on any of the three paths

Where it says so in the code

lib/check-read/read.ts (commit d77c6f7)
lib/assist/model.ts (commit d77c6f7)
lib/docgen/generate.ts, lib/docgen/facts.ts (commit d77c6f7)

Read 2026-08-23 by Claude (this session), from lib/check-read/read.ts, lib/assist/model.ts, lib/docgen/facts.ts at commit d77c6f7. To be read again by 2026-11-23.

Stripe (Stripe Payments Europe, Ltd.)

Taking payment, through an embedded pricing table.

What they see

organizations.id, sent as the embed's client-reference-id
her billing details, entered on Stripe's own form: name, address, card

What they do not see

any field of the register — no system name, no purpose, no assessment, no obligation
users.email, unless she types it into Stripe's own form

Where it says so in the code

components/pricing-table.tsx — client-reference-id={organizationId} (commit d77c6f7)
app/api/stripe-webhook/route.ts — receives, sends nothing (commit d77c6f7)

Read 2026-08-23 by Claude (this session), from components/pricing-table.tsx and app/api/stripe-webhook/route.ts at commit d77c6f7. To be read again by 2026-11-23.

Perplexity (Perplexity AI, Inc.)

One search call in the public classifier, for what third parties publish about a company.

What they see

the domain a visitor submits, inside the search prompt

What they do not see

the text of her pages — those go to Anthropic, not here
anything from a register: this runs before an account exists

Where it says so in the code

lib/check-read/research.ts — buildResearchPrompt(domain) (commit d77c6f7)

Read 2026-08-23 by Claude (this session), from lib/check-read/research.ts at commit d77c6f7. To be read again by 2026-11-23.

Google Fonts (Google LLC)

Typeface files, downloaded once at build time and served from our own origin.

What they see

Nothing. No request from anyone reading this site or using the product reaches them.

What they do not see

the request that loads a font file — it never leaves our origin, so no visitor IP, user agent or referrer reaches Google

Where it says so in the code

app/layout.tsx — next/font/google (commit d77c6f7)

Read 2026-08-23 by Claude (this session), from app/layout.tsx at commit d77c6f7, plus a build-output count of .next/static/media/*.woff2 and a repository-wide search for fonts.googleapis.com and fonts.gstatic.com. To be read again by 2026-11-23.