Trust
Sub-processors
Last updated 22 October 2026
The providers that process Customer Data or account information for Harmwise Guardrail, what they process, and where. We give at least 30 days' notice before a new one processes Customer Data (data processing terms, clause 4). The same list is Schedule 1 of the Terms.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Vercel Inc. | Hosting of the application, console and API | All requests to the Service, including conversation content submitted for grading | Functions run in Sydney, Australia |
| Supabase Inc. | Database | Customer Data, including the Record, retained quotes, findings decisions and queued requests | Sydney, Australia (AWS ap-southeast-2) |
| Microsoft Corporation (Azure) | The grader service, and archive storage | Conversation content submitted for grading, while it is graded (not stored); and records of the Record older than a year, which never contain conversation text | Australia East |
| Microsoft Corporation (Entra ID) | Sign-in for customers and staff | Name, email address and Microsoft tenant identifier | As set by Microsoft for the signing-in organisation |
| GitHub, Inc. and Google LLC | Optional sign-in for Developer accounts | Name and email address | As set by each provider |
| Anthropic, PBC | The model judge, only for organisations that turn it on | The conversation turns and reply being graded, while they are read; not retained for training | United States |
| Resend, Inc. | Notification emails, when switched on | Recipients' email addresses and the notice text, which never contains conversation content | United States |
| Stripe, Inc. and its affiliates | Payments, invoices and tax | Billing contact, address, ABN and payment details | Australia and other countries where Stripe operates |
No model or AI provider processes Customer Data today: grading uses deterministic rules that run on our own grader. If that changes, the provider will be listed here first.