This page lists the third-party service providers ("Subprocessors") that ElasticD3M, LLC engages to deliver the REL AI™ Services. The Data Processing Addendum governs how Subprocessors handle Personal Data. We give Customer at least thirty (30) days' advance notice of any new Subprocessor that will process Customer Personal Data, with a right to object.
Trade-compliance note. All listed Subprocessors are U.S.-domiciled or are bound by Standard Contractual Clauses with comparable trade-compliance covenants. None are organized in or operated from an OFAC-embargoed jurisdiction. ElasticD3M, LLC reviews Subprocessor sanctions status at onboarding and at least annually.
Active Subprocessors
| Subprocessor | Purpose | Data Scope | Location |
|---|---|---|---|
| Stripe, Inc. | Payment processing for REL AI™ engagement invoices where the applicable order form or statement of work provides for Stripe billing; consent collection at checkout. | Billing identity, payment method (Stripe stores card data; we receive only metadata). | United States (Delaware). stripe.com/privacy |
| Cloudflare, Inc. | Hosting, CDN, DNS, WAF, bot management, and Cloudflare Web Analytics for ai4rel.ai. No cookies on the analytics product. | Technical metadata (IP, user-agent, request paths); no Customer Data payload. | United States (global edge). cloudflare.com/privacypolicy |
| Railway Corp. | Cloud infrastructure: application and worker runtime, managed PostgreSQL, managed Redis, and the persistent volume holding the audit ledger. | Customer Data (configuration metadata, deliverables), identity / contact information, audit-log records. | United States. railway.com/legal/privacy |
| Resend, Inc. | Transactional email delivery (welcome emails, deliverable notifications, support replies). | Identity / contact information, email message contents. | United States. resend.com/legal/privacy-policy |
| Anthropic, PBC | Large-language-model inference (Claude API) supporting agent reasoning, analysis, and report drafting in the REL AI™ Services. | Security findings, configuration, and remediation context passed as model input; outputs are recommendations and report contents. | United States. Per Anthropic's commercial terms, model inputs are not used to train models and outputs are not retained beyond inference except as required for security and abuse detection (30-day rolling retention). anthropic.com/legal/privacy |
| Sentry (Functional Software, Inc.) | Application-error telemetry and performance monitoring for the production backend. | Stack traces, request metadata, scrubbed parameters; no Customer Data payload by configuration. | United States. sentry.io/privacy |
| Railway Corp. | Application hosting and deployment for the backend services that generate runbooks, render deliverables, and handle webhooks. | Customer Data in transit and at rest within the application boundary. | United States (multi-region). railway.com/legal/privacy |
| PostgreSQL (Railway managed) | Managed relational database for customer, engagement, deliverable, and audit-log state. Provisioned within the Railway account above, not as a separate provider. | Identity / contact information, account metadata, deliverable references, audit-log records. | United States. Encrypted at rest by the platform. |
How We Manage Subprocessors
- Due diligence at onboarding: Each Subprocessor is evaluated for security posture, applicable compliance certifications (SOC 2 Type II, ISO 27001, PCI-DSS where applicable), and contractual commitments substantially equivalent to those in our DPA. Sanctions and denied-party screening is run at onboarding.
- Annual review: Active Subprocessors are reviewed at least annually for continued compliance, updated certifications, and material changes in ownership or jurisdiction.
- Contractual flow-down: Each Subprocessor is bound by data-protection obligations no less protective than those in our DPA with Customer, including SCCs / UK IDTA where personal data crosses jurisdictional boundaries.
- Change notice: Customer receives at least thirty (30) days' advance notice of any new Subprocessor that will process Customer Personal Data, via update to this page and email to the primary account contact.
Right to Object
If Customer objects to a new Subprocessor, Customer may notify ElasticD3M, LLC in writing within thirty (30) days of the notice. The parties will work in good faith to resolve the objection (for example, by configuring the Services to avoid the new Subprocessor for Customer's account). If the parties cannot resolve the objection, Customer may terminate the affected portion of the Services and receive a pro-rata refund of any unused prepaid fees.
Contact
Subprocessor questions or objections: privacy@elasticd3m.com
Last Updated: August 31, 2026 · Version: 2.0