CadreGPT Compliance Directory • GDPR Article 28 Disclosure
Authorized Subprocessors & AI Infrastructure Directory
As a Data Processor under global privacy regulations (GDPR, UK GDPR, and CCPA), CadreGPT engages third-party infrastructure and foundation model subprocessors. Each vendor is vetted through formal security reviews and bound by strict Data Processing Agreements.
Current Directory Version: v2026.4•Last Substantive Audit: October 2026•● All Subprocessors In Good Standing
30-Day Subprocessor Change Notification & Right to Object
In accordance with Clause 9 of the EU Standard Contractual Clauses and our Data Processing Addendum, CadreGPT provides Customers at least thirty (30) calendar days advance written notice before authorizing any new subprocessor. Customers may object to new subprocessors on reasonable data protection grounds by contacting [email protected].
Section 1
Commercial Foundation AI Model Subprocessors
Vendors providing underlying machine learning inference for autonomous task generation, analysis, and tool routing.
| Subprocessor Name | Purpose / Models Provided | Data Training Policy | Processing Location | Compliance Standard |
|---|---|---|---|---|
Google LLC Google Cloud Platform (Vertex AI & Gemini Commercial API) Vendor Profile | High-reasoning, multi-modal analysis, and fast agent execution (Gemini 2.0 Flash & Pro models) | ✓ Zero Training Guaranteed Zero Training on API Data (Guaranteed under Google Cloud Commercial Data Terms) | United States & Global Google Cloud Regions | SOC 1/2/3, ISO/IEC 27001, ISO 27017, ISO 27018, GDPR SCCs, HIPAA BAA |
Anthropic, PBC Anthropic Commercial API Vendor Profile | Advanced coding, recursive agent planning, and complex workflow orchestration (Claude 3.5 Sonnet & Haiku) | ✓ Zero Training Guaranteed Zero Training on API Data (Strict Commercial API Data Terms: Customer prompts never train base models) | United States (AWS us-east-1 / us-west-2) | SOC 2 Type II, ISO 27001, GDPR SCCs, HIPAA BAA Eligible |
OpenAI, L.L.C. OpenAI Enterprise & Commercial API Vendor Profile | Specialized reasoning, tool calling execution, and structured schema synthesis (GPT-4o & reasoning series) | ✓ Zero Training Guaranteed Zero Training on API Data (Zero-Data-Retention & Commercial Enterprise API terms) | United States (Azure / OpenAI US Infrastructure) | SOC 2 Type II, ISO 27001, GDPR SCCs, CCPA Compliant |
Section 2
Cloud Infrastructure, Database, Email & Billing Subprocessors
Enterprise cloud infrastructure providers supporting platform availability, cryptographic credential storage, and billing.
| Subprocessor Name | Service / Processing Purpose | Data Training Policy | Hosting Location | Compliance Certifications |
|---|---|---|---|---|
Amazon Web Services, Inc. / Supabase Inc. AWS & Supabase Enterprise Cloud Provider Website | Managed PostgreSQL database hosting, encrypted persistent storage volumes, and transactional queue persistence | N/A (Database & Storage Provider: No Model Inference) | United States (us-east-1) | SOC 1/2/3, ISO 27001, ISO 27017, ISO 27018, PCI-DSS Level 1, FedRAMP, GDPR SCCs |
Vercel Inc. Vercel Enterprise Platform Provider Website | Next.js application hosting, global edge routing, serverless execution, and frontend delivery | N/A (Hosting & Edge Delivery) | United States & Global Edge Network | SOC 2 Type II, ISO 27001, GDPR SCCs, CCPA Compliant |
Resend, Inc. / Amazon SES Resend Transactional Email Gateway Provider Website | Transactional email notifications, Human-in-the-Loop (HITL) approval drawer alerts, and security dispatch | N/A (Email Gateway) | United States | SOC 2 Type II, GDPR SCCs, TLS 1.3 Encrypted Transit |
Polar.sh / Stripe, Inc. Merchant of Record & Payment Infrastructure Provider Website | Subscription payment processing, invoice generation, compute credit top-up tokenization, and tax calculation | N/A (Financial & Billing Gateway) | United States & European Union | PCI-DSS Level 1 Service Provider, SOC 1/2, GDPR Compliant |
Upstash, Inc. / Redis Ltd. Serverless Redis Task Cache Provider Website | BullMQ distributed agent task locking, rate limiting synchronization, and ephemeral execution state caching | N/A (Transient In-Memory Cache) | United States & Global Edge | SOC 2 Type II, ISO 27001, Encryption at Rest & in Transit |
Cloudflare, Inc. Cloudflare Global Edge Network Provider Website | Web Application Firewall (WAF), volumetric DDoS defense, DNS management, and TLS 1.3 termination | N/A (Edge Security & CDN) | Global Anycast Edge Network (300+ Cities) | SOC 2 Type II, ISO 27001, PCI-DSS, GDPR SCCs |
Subprocessor Due Diligence & Annual Audit Protocol
Before engaging any third-party subprocessor, the CadreGPT Information Security and Legal Compliance team executes a rigorous four-phase vetting pipeline:
1. Security Architecture Review
Verification of independent SOC 2 Type II audit reports, ISO/IEC 27001 certifications, and continuous penetration test results.
2. Data Protection Agreements
Execution of contractual Data Processing Agreements incorporating the European Commission Standard Contractual Clauses (EU 2021/914) and UK Addendum.
3. Zero Model Training Guarantees
Mandatory contractual covenants explicitly prohibiting the subprocessor from using customer tokens, prompts, or execution outputs to train base models.
4. Annual Re-Assessment
Annual re-evaluation of supplier certifications, incident response history, encryption strength, and geographic transfer safeguards.
Have questions regarding our subprocessor network or data transfer impact assessments (TIA)?
Contact Security & Legal Team