Legal › Subprocessors
Subprocessors
The companies EnemoAi uses to provide the service, and exactly what each receives. This list is Annex 3 to our Data Processing Addendum.
Subprocessors
| Provider | Purpose | Location of processing | Data processed |
|---|---|---|---|
| Anthropic, PBC | AI model (Claude API) that writes answers and alert briefs | United States | Questions, earlier turns of the conversation, attached documents, retrieved source excerpts, and, when a business has connected its own data, the facts from it that bear on the question. Alert briefs use public records only. Under Anthropic’s commercial terms, no training on this content; kept for the period in Anthropic’s commercial data-retention policy, longer only where flagged for usage-policy enforcement or required by law. |
| Hetzner Online GmbH | Servers and database for the EnemoAi app and API, including search, read-aloud and storage | Helsinki, Finland (EU) | All customer and account data held by EnemoAi |
| Backblaze, Inc. | Storing encrypted nightly backups of the customer database, kept 30 days | United States | The same data as Hetzner, but only as encrypted files: the key is held only by EnemoAi and never given to Backblaze, so Backblaze cannot read them |
| Google LLC (Google Workspace) | Sending alert, briefing and account-closure emails; our mailbox for hello@enemo.ai | United States and Google’s other data centers | Recipients’ names and email addresses; the content of alerts, briefings and closure confirmations; messages you send us |
| Stripe, Inc. and its affiliates, including Link | Selling wallet top-ups and the Monitoring subscription as merchant of record; payment processing, tax, receipts | United States and other countries where Stripe operates | The email address of the owner who first pays, the business’s legal name, our internal numbers for the business and the person paying, purchase amounts and refunds; payment details entered directly with Link. For transaction data, Link acts as an independent controller. |
| Vercel Inc. | Hosting the website at www.enemo.ai (pages, images and the app’s code) | Global edge network; United States | IP address, browser details and the pages requested. The app’s data goes directly to our API at api.enemo.ai, not through Vercel, and the sign-in cookie is never sent to Vercel. |
Identity provider
| Provider | Role | Location | Data |
|---|---|---|---|
| WorkPair Incorporated (an affiliate of EnemoAi: both Enemo Consulting Group, Inc. and WorkPair Incorporated are wholly owned subsidiaries of The Ravine of Willows, Inc. They are distinct companies, and EnemoAi pays for WorkPair’s services like any other customer.) | Verifies people and businesses and signs them in. WorkPair acts as an independent controller of each WorkPair ID under its own privacy policy. | As described in WorkPair’s privacy policy | Learns that a person is signing in to EnemoAi and which organization they share. Sends EnemoAi the claims listed in our Privacy Policy. Receives no questions, documents or answers. |
Push notification services (our apps)
Used only for people who allow notifications in an EnemoAi app. EnemoAi uses them for its own account administration (DPA Section 2.2); they receive no customer data.
| Provider | Purpose | Location of processing | Data processed |
|---|---|---|---|
| Apple Inc. (Apple Push Notification service) | Delivering notifications to the EnemoAi apps on Apple devices | United States and Apple’s other data centers | The device’s push token, a short title and a link that opens the app. Never questions, answers, documents, company names, figures or business data |
| Google LLC (Firebase Cloud Messaging) | Delivering notifications to the EnemoAi app on Android | United States and Google’s other data centers | The same as for Apple |
Providers that receive no customer data
- Cloudflare, Inc.: domain name service for enemo.ai, and storage (R2) of EnemoAi’s archive of public SEC filings.
- Backblaze, Inc.: also keeps a second copy of that public archive (United States).
- Google Fonts: the typeface on the app’s pages; your browser requests it directly (see the Cookie Notice).
Software that runs on our own servers
Search embeddings (the open-source bge-small model through fastembed) and read-aloud voices (the open-source Kokoro model) run on our servers in Helsinki. Their makers receive no data.
Public sources
EnemoAi reads public records from the SEC, U.S. bankruptcy courts, the FDIC, the Treasury Department (OFAC), the FDA, the Consumer Product Safety Commission, the Justice Department, the Federal Register, the Consumer Financial Protection Bureau, the Labor Department, the EPA, NHTSA, USAspending.gov, the Commerce Department’s International Trade Administration (Consolidated Screening List), the Federal Trade Commission, the National Labor Relations Board, U.S. district courts, state labor departments (WARN notices), and state business registries and UCC filing offices (read from the states’ own open-data portals). They are sources, not subprocessors: we download their published records in bulk or by public identifier, and never tell them which customer asked about or watches whom.
Changes
We update this page and email each account owner at least 30 days before a new subprocessor begins processing customer personal data, except in an emergency, when we give notice as soon as practicable. Owners may object under Section 6.3 of the DPA.
- 2026-11-01: first version.
- 2026-11-01.2: what Anthropic receives when a business has connected its own data.
- 2026-11-01.3: the push notification services our apps use.