RoboGrant9000 — Sub-processors
This page lists the third-party service providers ("sub-processors") that process customer data to run RoboGrant9000. It reflects the provider set described in our Privacy Policy (section 7) and is kept aligned with it.
Last updated: August 16, 2026 Status: Living document — see "Changes to this list" below.
What a sub-processor is
To deliver RoboGrant9000 — AI research and drafting, image generation, sign-in, payments, hosting, background jobs, transactional email, and error monitoring — we rely on a small set of trusted service providers. A sub-processor is a company we engage that may process customer data on our behalf to provide part of the service.
Two things are true of every provider below:
- Your data's primary home is Canada. Our database and document storage run in the AWS Canada–Central region (Montréal) under PIPEDA. The first row in the table comes first for a reason.
- Customer content is processed, not sold. We use customer data only to provide, secure, and support the service. We do not sell it, we do not use it for advertising, and we do not use one customer's data to serve another. We never use customer data to train AI models, and we engage our AI providers under commercial API terms on the basis that data sent through their APIs is not used to train their models.
Current sub-processors
| Sub-processor | Purpose | Data processed | Region |
|---|---|---|---|
| Supabase (on AWS) | Primary data store — Postgres database, document storage, and the search index for everything your organization puts into the service | Organization profile and intake, uploaded documents, research evidence and sources, drafts, tracker records, conversations, usage and audit records | Canada — AWS ca-central-1 (Montréal) |
| Anthropic (Claude) | AI drafting, chat, and extraction — generating drafts, extracting facts from your documents, and powering chat | Organization profile, extracts of uploaded documents, draft contents, chat messages, eligibility inputs (e.g. CRA business number) | United States |
| Voyage AI | Text embeddings — converting text into the numerical form that powers search and retrieval inside the service | Text passages from your knowledge base, research evidence, and search queries | United States |
| xAI (Grok) | AI web research, grant-opportunity discovery, and source verification — live research over public sources on our behalf | Organization profile context, research queries, and extracts of uploaded documents (during organization research); gathers publicly available statistics and reports | United States |
| kie.ai | AI image generation — creating images requested in chat | Model-written image prompts, which may include organization details and conversation content, and the generated images | United States |
| Clerk | Authentication and organizations — sign-in, user accounts, organization membership, and seat invitations (including Google sign-in) | Name, email address, sign-in credentials, organization membership and role, invitee email addresses | United States |
| Stripe | Billing — subscriptions, invoices, and payment processing | Payer email, payment method, invoices and subscription records (we never see or store full card numbers) | United States / global |
| Vercel | Hosting and CDN — serving the portal and all API traffic | All portal and API requests pass through it in transit | United States / global edge |
| Trigger.dev | Background jobs — running research, drafting, and scheduled opportunity-discovery and reminder tasks | The organization data needed to execute a given job during the run | United States |
| Resend | Transactional and operational email — delivering deadline reminders and operational notices on our behalf | Recipient email addresses and message content (for example, an upcoming grant deadline) | United States |
| Sentry | Error monitoring — technical error reports so we can find and fix defects | Error details and internal record identifiers — not personal information | United States |
| Cloudflare | Domain name services and email routing (including our support mailbox) | Domain traffic routing and the routing of email to and from our support mailbox | Global |
| Optional sign-in identity (via Clerk), if you choose "Sign in with Google" | Google account identity (name and email) used to sign in | United States / global |
Data residency and PIPEDA
Your organization's data is stored in Canada (Supabase on AWS ca-central-1, Montréal), which we chose deliberately and intend to keep. Delivering the service nonetheless involves processing in the United States and on global infrastructure — AI research and drafting, embeddings, sign-in, payments, email routing, background-job execution, hosting, and error monitoring. When data is processed outside Canada it is protected by our contracts with each provider, and it may also be subject to the laws of the country where it is processed. This is described in full in our Privacy Policy (at /privacy), sections 6–8.
How we manage sub-processors
- We engage a provider only where it is needed to deliver the service, and we limit what each one receives to what its role requires.
- We rely on each provider's standard data-processing terms.
- We remain accountable for customer data while it is in a provider's hands.
Changes to this list
This is a living document. We update it when we add, remove, or change a sub-processor, and we give customer organizations notice of material changes consistent with our Privacy Policy.
Contact
Questions about this list, or to request our data-processing terms, contact support@robogrant9000.com.