Every third party that touches your data, listed by name.
When Emaration runs an audit or an ongoing engagement, a small set of well-known vendors help us do the work. This page lists each one, what they do for us, what client data they could see, and where they sit. It is the canonical list referenced by our Terms and our Data Processing Addendum.
Last updated: July 25, 2026 · Effective for: all clients under MSA / DPA v1 · Change notice: 15 days in advance, by email.
What "sub-processor" means. Under our DPA, you (the client) decide what data is collected and why. We process it on your instructions. A sub-processor is any third party we use to help us do that: a cloud platform, an AI vendor, an analytics tool. Every vendor below is bound to data-protection terms no less protective than our DPA.
1. Core infrastructure 5 vendors
The platforms our product runs on: edge compute, the database of record, payments, transactional email, and business email.
Cloud platform
Cloudflare, Inc.
The core platform Emaration.AI runs on: Workers (compute + server rendering), D1, KV, Queues, Vectorize, and R2 (storage), Cloudflare Access (operator authentication), Workers AI (site concierge), plus DNS, registrar, and email routing for emaration.ai.
Data touched
Standard request logs; audit artifacts and client-attributable data processed at the edge during a run; operator auth sessions.
Serverless Postgres — our database of record for the CRM: client accounts, intake responses, contacts, and the AI usage ledger. Row-level security scopes each client to its own data.
Data touched
Client business records, intake form responses, contact details, and per-client project data once onboarded.
The model vendors our orchestration routes work to. See the methodology for how we choose, evaluate, and fall back.
Foundation model (primary)
Anthropic PBC — Claude API
Our primary model: reasoning, audit-narrative writing, content drafts, and full-context interpretation. Routed through one shared client on a dedicated organization key.
Data touched
Excerpts of your analytics, content, and text we pass in to perform the task. Anthropic does not train on API data by default.
These vendors are only engaged when a specific deliverable in your scope of work requires them, for example a local-citation push or stock imagery for a content sprint. We disclose them in your monthly report and on your individual sub-processor schedule before any data is sent.
Local citations
BrightLocal / Yext (à la carte)
When local SEO citations are in scope. Data: business name, address, phone, hours. Location: United States / United Kingdom.
Stock imagery
Unsplash+ / Adobe Stock
For licensed visuals in content sprints. No client data passes to these vendors.
Vertical-specific
Per-engagement specialist tools
Occasionally needed for a specific vertical's data (e.g., veterinary scheduling integrations). Always disclosed before activation, always opt-in.
6. Notification of changes & right to object
We commit to giving you advance notice before any vendor on this list changes in a way that affects how your data is processed.
30-day change notice for the public list. The list above is the canonical record. When we add or replace a sub-processor that will process client data, the list updates here at least 30 days before the change takes effect for new engagements.
15-day individual notice for existing clients. Active clients also receive direct email notice at least 15 days before the change applies to their account, per Section 6.4 of the DPA.
Right to object. Within 10 days of receiving notice, you may object on reasonable data-protection grounds. If we cannot resolve the objection together, you may terminate the affected SOW without penalty.
Get notified. Email human@emaration.ai with "Sub-processor change notifications" in the subject and we will add you to the change list. No marketing; this list is used for change notice only.
Questions about a specific vendor? Email human@emaration.ai. A founder will respond within one business day. If you need a security questionnaire response or a written confirmation of a sub-processor's status under your DPA, ask and we will send one.
Emaration.AI