Subprocessors
Last updated 12 November 2026.
This page lists every outside company that handles customer data for Duelpoint, what it receives, why, and where it stores and processes it. Duelpoint is in its pilot: no customer data has been sent to any of these companies yet. Before any customer data reaches a provider, its data processing agreement is in place and its strictest retention setting is turned on. We update this page, and tell customers, before a new company receives customer data.
AI providers
| Provider | What it may receive | Why | Where data is stored and processed (per the provider's own statements) | Status |
|---|---|---|---|---|
| Anthropic | Customer test conversations, for our simulated customers and for judging; synthetic and internal data | Plays the test customers, reads what the agent did, judges honesty and tone, and writes the plain-language summary of an Assessment report (from the report's own findings and counts, never from conversation text) | Deleted within 30 days by default; zero retention only by agreement. Regions to confirm from the Trust Center before the first customer run. | Account in use for testing with synthetic data. Data processing terms and retention setting completed before the first customer run. |
| DeepInfra (hosts DeepSeek V4 Flash) | Synthetic and internal data now. Customer data only after the Section 17.3.2 checklist is complete and the founder approves. | A cheaper model for test customers and judging | Company based in Palo Alto, California; says inference inputs are not stored on disk and request content is not logged; processing locations are NOT stated (it has a Toronto data centre as well as US ones); SOC 2 and ISO 27001 are claimed on its site, audit reports not yet seen | Disabled for customer data. Checklist open. |
Not used: DeepSeek's own API (stores data in China; also dearer than Claude Haiku for our workloads). DeepSeek's own API receives no customer data, ever: the code refuses it. Never allowed at all: Claude Opus, Claude Fable and Mythos, DeepSeek Pro.
An owner can choose, on the Your data page, to have Anthropic only handle the organization's data.
Other services
| Service | What it receives | Why | Status |
|---|---|---|---|
| Amazon Web Services (Lightsail server) | Everything passes through the server while it runs; nothing is kept on its disk | Runs Duelpoint | Chosen 2026-11-10; the pilot runs on one server |
| Supabase (database and file storage) | The database (accounts, orders, findings, scores) and the stored files (conversations, reports, evidence) | Holds Duelpoint's data | Chosen 2026-11-07, file storage 2026-11-10; holds test data only so far |
| Google Workspace (email sender) | Work email addresses, message text | Confirmation links, reports ready, deletion reminders | Chosen 2026-11-10 (the company's own Google Workspace, admin@duelpointai.com) |
| Stripe | Our organization id, payment (Stripe collects the card and billing details itself) | Prepaid card payments and the saved card for Continuous testing | Test mode during the pilot set-up; live at launch |
Not used: text messages (sign-up is confirmed by email only), and any outside sanctions-screening company. Sanctions screening runs on our own server against the US Treasury's free public lists (OFAC), which we download; no business name leaves our server for it.