Sub-processors

Status: DRAFT — pending legal review.

Last updated: 2026-07-01 (draft)

crate uses the third-party providers below to process personal data on our behalf ("sub-processors"). We stay accountable for their handling of your data under our Privacy Policy and DPA. We will post intended additions or replacements on this page at least 30 days in advance (per DPA §4, which also gives you an objection/termination right); account holders may subscribe to change notices by emailing privacy@hosaka.fm.

| Sub-processor | Purpose | Personal data processed | Location | |---|---|---|---| | Amazon Web Services (AWS) | Cloud hosting: compute (ECS), managed database + Redis cache (ElastiCache), object storage (S3), CDN (CloudFront), email (SES) | All service data (account, usage logs, IP) | Primary region United States (us-east-1). CDN note: CloudFront serves via global edge locations, so request metadata (including your IP) is processed transiently at the edge location nearest the caller worldwide; stored service data remains in us-east-1. | | Stripe | Payment processing + subscription billing | Email, name, billing details, card data (held by Stripe — not by crate) | United States / global (Stripe entities) | | Amazon SES | Transactional email (magic-link sign-in, billing notices). SES is an AWS service — listed separately for clarity of the email flow. | Email address | United States (us-east-1) | | Anthropic (optional AI features only) | Natural-language search interpretation + wayfind answer synthesis | The query text you submit only when you use ?nl=true or the wayfind endpoints (PII-redacted before sending; not persisted by crate; not used by Anthropic to train models) | United States |

Notes

  • Anthropic is engaged only for the opt-in AI features. If your integration never calls ?nl=true or /api/v1/wayfind/* — i.e., the base faceted-search + enrichment product — no data about your requests is sent to Anthropic. Operators may disable the AI features for their deployment entirely.
  • Stripe is an independent payment processor; card data is collected and stored by Stripe under its own PCI-compliant terms and is never transmitted to or stored by crate.
  • Where these providers process EEA/UK personal data in the US, transfers rely on the EU Standard Contractual Clauses (and UK Addendum) in each provider's data-processing terms.
  • Anthropic's own sub-processor chain (its cloud-infrastructure providers) is published in Anthropic's trust documentation; its data-handling commitments are set by its commercial terms, referenced from our Privacy Policy §4.