Sub-processors
Appraisal Report Audit, a Product of Edge Realty Advisors.
Last updated: 2026-08-01.
Appraisal Report Audit relies on the following third-party service providers (“sub-processors”) to operate. Each sub-processor is bound by a data processing agreement and is permitted to process data only as needed to deliver the Service to us. Adding or removing a sub-processor triggers a Privacy Policy update with at least 14 days' notice, per our Privacy Policy.
| Sub-processor | Purpose | Handles NPI? | Agreement |
|---|---|---|---|
| Anthropic, PBC | LLM API: primary audit model that generates findings from uploaded reports | Yes (prompt body containing Customer Content) | Accessed via zero-data-retention model routers (Vercel AI Gateway; OpenRouter on failover) — no training; no retention after response |
| OpenAI, L.L.C. | LLM API: second-pass verification of findings (and optional primary audit model) | Yes (prompt body containing Customer Content) | Accessed via zero-data-retention model routers (Vercel AI Gateway; OpenRouter on failover) — no training; no retention after response |
| Microsoft Corporation (Azure OpenAI Service) | Model processing: serves GPT models when selected by router availability | Yes (prompt body containing Customer Content) | Accessed under zero data retention; no training, no retention after response |
| Google LLC (Vertex AI) | Model processing: serves Claude models when selected by router availability | Yes (prompt body containing Customer Content) | Accessed under zero data retention; no training, no retention after response |
| Amazon Web Services, Inc. (Bedrock) | Model processing: serves Claude models when selected by router availability | Yes (prompt body containing Customer Content) | Accessed under zero data retention; no training, no retention after response |
| OpenRouter, Inc. | Failover model router used when the primary AI Gateway is unavailable | Transient (model prompts in flight; prompt logging not enabled) | Zero-data-retention routing; requests pinned to zero-data-retention endpoints only |
| Cloudflare R2 | Object storage: input PDFs, output Word documents, voice corpora | Yes (file payloads, encrypted at rest) | Cloudflare standard DPA |
| Supabase | Application database: accounts, jobs, findings, billing records | Yes (extracted fields) | Supabase DPA |
| Vercel | Web hosting and AI Gateway: serverless runtime plus the primary zero-data-retention model router for AI inference | Transient (request bodies and model prompts in flight) | Vercel DPA; AI Gateway zero-data-retention configuration |
| Railway | Background worker compute: PDF text extraction, audit and verification model calls, Word document generation | Yes (report content processed during the audit) | Railway DPA |
| Clerk | Authentication and user identity | No file content; account metadata only | Clerk DPA |
| Stripe | Payments and subscription billing | No file content; payment data only | Stripe DPA |
| Resend | Transactional email (job-complete, billing, account) | Recipient address and non-NPI body text only; no attachments | Resend DPA |
| Sentry | Error and exception monitoring | Scrubbed; PII/NPI filters configured | Sentry standard DPA |
| PostHog | Product analytics (loaded only after cookie consent) | Scrubbed; PII/NPI filters configured | PostHog standard DPA |
Hosting region
All sub-processors operate primarily in the United States. Some (Cloudflare, Vercel) operate globally and may route requests through edge nodes outside the U.S. for performance; durable storage of Customer Content remains in U.S. regions.
No training on Customer Content
AI inference is routed through zero-data-retention model routers: the Vercel AI Gateway, and OpenRouter as a failover route used when the primary router is unavailable. Both are configured to send requests only to model endpoints operating under zero-data-retention agreements. Which provider serves a given request depends on router availability and capacity, so any of the model providers listed above may process a request. Under those agreements, Customer Content is not used to train models and is not retained after the response is returned. No other sub-processor receives Customer Content for training purposes.
Questions
Contact privacy@appraisalreportaudit.com.