Note

Here is the full list of sub-processors at 21RISK. A sub-processor is a third-party data processor engaged by 21RISK, who agrees to receive data from 21RISK in accordance with instructions given by 21RISK.

Name	Activities	Country	Notes	Compliance
Planetscale	Database as a Service	USA	Data is stored in AWS eu-central-1. Read more here	SOC2 Type 2
Vercel	Platform for applications, AI Gateway and sandboxes	USA	Vercel is where our frontend and backend is hosted, running serverless and edge functions. Every AI request goes through the Vercel AI Gateway, which 21RISK's requests tell to pass them on only to Anthropic or Voyage AI (below). The AI assistant runs its agent in a Vercel Sandbox, a virtual machine in Frankfurt (fra1); the code agents run, the reading of uploaded documents and their virus scan run in Vercel Sandboxes in Frankfurt too. Read more here and here	SOC2 Type 2
Doppler	Secrets service	USA	Secrets management. Read more here	SOC2 Type 2
Pusher (by Bird, formerly MessageBird)	Realtime cloud services	United Kingdom	We use Pusher to enable real-time collaboration in our application, on its EU cluster in AWS Ireland.	ISO/IEC 27001:2013
Cloudflare	Cloud services	USA	We use Cloudflare to manage DNS configuration & backups, and to store and serve all files: the files users upload, and 21RISK's public files (website, documentation and product update images), from Cloudflare R2 in the EU. Read more here	SOC2 Type 2, ISO27001
Google Cloud	Backup storage	USA	Keeps the off-site backup of the files users upload, in a Cloud Storage bucket in the EU. Read more here	SOC2 Type 2, ISO27001
Mux	Video hosting and streaming	USA	Hosts and streams 21RISK's own videos: on the website, in the documentation and product updates, and the video introductions in the web-application. Training videos customers upload are stored on Cloudflare R2, not with Mux. Read more here	ISO27001, GDPR, EU-US DPF
Voyage AI (by MongoDB)	AI embeddings	USA	Turns the text of the documents customers upload, and the descriptions of their images, into embeddings, which describe what each page is about, so the AI assistant and agents can search them by meaning. Only for organizations that have turned on AI, through the Vercel AI Gateway. The requests ask for no training, so only a Voyage AI service that doesn't train on the data may serve them; they don't ask for zero data retention, which Voyage AI doesn't offer through the Gateway. Read more here	SOC2, HIPAA
Anthropic	AI assistant and agents, AI navigation, reading engineering reports, translation, image labels and descriptions, and reading scanned pages	USA	Answers in the AI assistant and agents, in the tier chosen (Fast: Claude Haiku 5.5, the default; Balanced: Claude Sonnet 5.5; Powerful: Claude Opus 5.5), and receives the chat messages, the results of the 21RISK queries the assistant runs and the files attached in chat. Also picks the page and filters for Go there with AI and Filter with AI (Claude Haiku 5.5), from the text typed and the pages, columns and filter values on offer, and reads the text of the insurance engineering reports customers upload (Claude Haiku 5.5), together with the names of the sites the user has access to and the insurance board's statuses and categories, and, for GRC reports, the organization's synced GRC recommendation records for that report, including the names and comments of the people who responded to them, who performed the inspection and the loss and cost estimates, when someone asks it to suggest the report's site and risk improvements. Go there with AI and Filter with AI are for Enterprise organizations; they and the reading of engineering reports also run where AI isn't turned on. For organizations that have turned on AI, Anthropic also translates the names and instructions on safety-walks boards that are translated (Claude Opus 5.5); looks at the images customers upload and labels what is in them (a person, an identifiable face, suggestive or explicit content), so 21RISK administrators can find images that need a look, and describes what each shows and the text in it, so the AI assistant and agents can find them by searching; and reads the pages of uploaded PDFs that have no usable text of their own, such as scans, from an image of each page, so they can be searched too (Claude Haiku 5.5). Every one of these requests goes through the Vercel AI Gateway to Anthropic alone, with zero data retention: Anthropic keeps no copy of the data and doesn't train on it. Read more here	SOC2 Type 2, ISO27001, ISO42001
Sentry	Cloud services	USA	Sentry is used for error handling and monitoring.	SOC2, ISO27001
PDF Shift	Generate PDF's	France	When users export pages as PDF's in 21RISK, it's powered by PDF Shift
Lettermint	Email service	Netherlands	Lettermint is used to send transactional emails.	GDPR

Last updated November 4th, 2026