Cloudflare, Inc.
CDN, edge compute, DNS, Turnstile, Web Analytics, R2 storage. Visit metadata, IP (truncated for analytics), form submissions.
A current list of every sub-processor, every certification, and every change since the last revision.
What follows is the working truth — updated when it changes, never when it is convenient. If a vendor appears anywhere on cmintel.ai that is not in this list, that is a bug; mail trust@cmintel.ai.
Sub-processors
Supabase Inc.
Primary operator database (PostgreSQL 16). Account data, user-generated content.
SendGrid (Twilio Inc.)
Transactional email, contact-form delivery, DSAR verification emails. Email address, message content.
Stripe Payments UK Ltd
Payment processing, on activation of subscription billing (Phase 7). Email, payment card token (Stripe-vaulted).
Anthropic, PBC
Language-model inference for the Colosseum agent stack. Anonymised content drafts and prompts.
OpenAI, LLC
Language-model inference for specific Colosseum agents. Anonymised content drafts and prompts.
Sentry (Functional Software, Inc.)
Error monitoring. Error stack traces, anonymised user identifiers — PII scrubbed before transmission.
Certifications
SOC 2 Type II — in progress; engagement letter signed with auditor 2026-04-22, audit window starts 2026-Q3.
ISO 27001 — under evaluation; we will commit publicly when the engagement begins.
UK GDPR Article 30 record of processing activities — maintained internally; available to data subjects and supervisory authorities on request via dpo@cmintel.ai.
Change log
- 2026-05-04
Sub-processor list published. Initial v1 set: 7 vendors. Stripe entry pending payment activation.
- 2026-04-30
Quarterly vendor review. All seven sub-processors confirmed under signed DPA.
Subscribe to changes: mail trust@cmintel.ai.
Last updated 2026-05-04