Processor List
Premwise Processor List
Version 2026-08-30.1. PUBLISHED at `https://premwise.ai/legal/processors`, the location stated in the Privacy Policy at `Legal/05` §5.1, as MSA §8.2(e) requires. This document is incorporated by reference into the Premwise Master Services Agreement at §1.1(6) and §8.2(e) (`Legal/31`, v2026-08-21.1). The MSA now depends on it, so it must be published at a stable URL before the first Customer accepts those Terms — publication is gated with `/legal` under `TASK-175`.
Purpose. MSA §8.2(e) commits Premwise to engage subprocessors only under written terms no less protective than §8.2, to remain responsible for their performance, and to identify each subprocessor here, with notice of additions before they begin processing. This list is that identification.
Scope, stated precisely. A subprocessor is a third party Premwise engages that processes Customer Personal Data — personal information contained in Customer Content, or account and contact data — on Premwise's behalf. Vendors that never touch Customer Personal Data are deliberately excluded and are not made to look like subprocessors: the code host and CI (GitHub), and the rating-bureau and regulator sources from which public filed rating values are obtained, are sources and tooling, not processors — no Customer Content is sent to them.
Subprocessors
| # | Provider | What it does for Premwise | Categories of data processed |
|---|---|---|---|
| 1 | Supabase, Inc. | Application database, authentication, and object storage for customer-uploaded documents | Customer Content including uploaded worksheets, loss runs and payroll files; account identifiers; authentication events |
| 2 | Vercel Inc. | Application hosting and serverless compute — the product itself runs here | Customer Content in transit and in request/response processing; account identifiers; request metadata |
| 3 | Anthropic PBC | AI-assisted extraction of fields from customer-supplied documents | The contents of documents submitted for analysis, which may include employee, payroll, policy, claim and loss-run information |
| 4 | Cloudflare, Inc. | Object storage (R2) for backups of the database | Account, business and analysis records contained in the database, as backup copies, and encrypted copies of customer-uploaded documents. The `documents` bucket is synchronised to Cloudflare R2 daily, encrypted before it leaves (`.github/workflows/backup.yml`, cron `41 3 `), with a per-object readback digest and a retention rule of 30 days (ceiling 90). The database backup separately carries the `storage.objects` index (path, size, type, owner) and not the file bytes. CORRECTED 2026-08-26. Superseded: "Customer-uploaded documents are NOT backed up here today".* That was TRUE when written on 2026-08-21 and became false the next day, when `TASK-383` shipped the documents sync; the 2026-08-23 revision corrected row 9 without re-checking this row. Founder decision 2026-08-26 on `TASK-420` |
| 5 | Stripe, Inc. | Payment processing, subscription billing, and invoicing | Billing contact details and transaction records. Premwise does not receive or store full payment-card numbers |
| 6 | Resend, Inc. | Transactional and operational email delivery | Recipient email address, name where included, and message contents |
| 7 | Functional Software, Inc. (Sentry) | Application error and performance monitoring | Diagnostic and error data, which may incidentally include identifiers present in a failing request |
| 8 | HubSpot, Inc. | Customer-relationship records for prospects and customers | Business contact data — name, email, company, and self-declared premium band |
| 9 | Plausible Insights OÜ | Product and site analytics | Page paths and aggregate usage, per scope. Signed-out product pages: page path only — the query string is removed in full, so authentication tokens and continuation values are never transmitted. Marketing site: page path plus only the campaign parameters named here — `ref` and any `utm_` parameter (`utm_source`, `utm_medium`, `utm_campaign`, and the like) — every other query parameter is removed. No signed-in product page is measured at all. (`app/lib/analytics.ts`, `site/lib/analytics.ts`) |
Change control
Additions require notice to Customers before the new subprocessor begins processing, per MSA §8.2(e). Each change updates this file's version and date, and the entry states what changed.
| Version | Date | Change |
|---|---|---|
| 2026-08-21.1 | 2026-08-21 | Initial list. Created because MSA v2026-08-21.1 removed the Data Processing Addendum and moved subprocessor identification into these Terms plus this list (founder decision 2026-08-20; FVA-005). |
| 2026-08-21.2 | 2026-08-21 | Row 4 corrected. It read "backups of the database and stored documents". No customer-uploaded document has ever been copied to Cloudflare — the database backup carries the `storage.objects` INDEX and none of the file bytes, so the row described protection a Customer does not have. Found on a founder-directed backup audit, 2026-08-21; the row had been written from the authorization to add Cloudflare as a subprocessor rather than from a measurement. Corrected in the direction of what is true today; it will be amended again when document backup actually lands (`TASK-383`). This file is not hash-locked by FVA-005 (which covers `Legal/31` only) and is not in `Legal/MANIFEST.sha256`, so no executed acceptance is disturbed. |
| 2026-08-26.1 | 2026-08-26 | PUBLISHED, and row 4 corrected. Founder decision 2026-08-26. (a) The `DRAFT — NOT PUBLISHED` banner is removed and the list is published at `https://premwise.ai/legal/processors`; `Legal/05` §5.1 now states that URL, satisfying MSA §8.2(e)'s requirement that subprocessors be identified on a list "published at the location stated in the Privacy Policy". (b) Row 4 said customer-uploaded documents are NOT backed up to Cloudflare. True on 2026-08-21; false from 2026-08-22 when `TASK-383` shipped the daily encrypted `documents` → R2 sync. The 2026-08-23 revision corrected row 9 and did not re-check row 4. `TASK-420`. |
| 2026-08-30.1 | 2026-08-30 | Removed a pre-publication checklist section that had remained in the document after publication. No subprocessor row changed and no statement about a provider was added or withdrawn. |
| 2026-08-23.1 | 2026-08-23 | Row 9 corrected — it described a configuration that has never existed. It read "Configured to send page paths only, with query strings stripped". That was true of signed-out product pages and FALSE of the marketing site, which transmits the full query string. Row 9 is now stated per scope and names the campaign allowlist explicitly — `ref` and any `utm_` parameter — rather than relying on a general phrase. Founder direction 2026-08-23: amend the instrument to match the code; narrowing the runtime to strip everything was REJECTED because it would remove campaign attribution the published notice already discloses. At the time of this entry the marketing half was not yet live, and publication was gated on it. That gate was recorded in a pre-publication checklist section which was SATISFIED on 2026-08-26 and removed from this document on 2026-08-30; the history is here rather than there. `TASK-404`. |