Overview

CAIRL publishes the current subprocessor list used in our Data Processing Agreement. Providers receive only the data necessary to deliver their scoped service, and CAIRL remains responsible for user-facing privacy and security commitments.

Subprocessor List

Provider	Purpose	Location
Amazon Web Services (AWS)	Cloud infrastructure, identity verification processing (Rekognition, Textract), document storage (S3), serverless compute (Lambda)	United States
Stripe	Payment processing and billing	United States
Vercel	Website hosting and content delivery	United States (global edge)
Mailgun	Email delivery and proxy relay	United States
Google Cloud (reCAPTCHA Enterprise)	Bot protection (score-based) on public forms	United States
Upstash	Rate limiting and session caching	United States
Twilio	Phone verification (OTP delivery)	United States
Plaid	Bank account verification	United States

Updates

CAIRL keeps this page synchronized with the Data Processing Agreement subprocessor table. Customers with a signed Data Processing Agreement may receive additional notice rights under that agreement.