M·01
Legal · Sub-processors
Every vendor with access.
We notify customers 30 days before adding a new sub-processor. The Safeguards column lists the concrete protection in place — not a checkbox.
Notice period30 days before any addition
Data residencySupabase · Frankfurt
Contactsecurity@misano.ai
M·02
| Vendor | Purpose | Data accessed | Location | Safeguards |
|---|---|---|---|---|
| Supabase | Database, authentication, file storage | All customer data | EU · Frankfurt | EU data residency |
| Anthropic | LLM inference (Claude) | Document text + KB at point of inference | EU + US | No training on your data |
| OpenAI | LLM inference | Document text at point of inference | US | No training on API data |
| Exa | Neural web search (Scout, at your direction) | Query strings only | US | Query-scoped, no PII stored |
| Stripe | Payments and invoicing | Billing details, no product data | EU · Ireland | PCI DSS Level 1 |
| Resend | Transactional email | Recipient address + message content | US | Email-scoped |