Sub-processors list.
The named third parties Aculeus engages to operate the workbench and to produce readings. Each is engaged under a written contract imposing confidentiality, security, and processing restrictions consistent with applicable data-protection law and the Aculeus Data Processing Addendum (DPA).
The region shown is each provider’s default processing region. Specific regional, single-tenant, or US-data-residency arrangements are available to enterprise tenants under the DPA — when a workspace is pinned to US data residency, content is routed only to providers cleared for that posture, and a run that cannot be served compliantly is refused rather than routed elsewhere.
AI & research providers¶
These providers process customer content — the brief, retrieved records, and the source trail — to research a subject and generate a reading. They are the providers a workspace’s data-residency posture governs.
| # | Sub-processor | Function | Region |
|---|---|---|---|
| 01 | DeepSeek | Brief synthesis, case chat, and audience render generation. | China |
| 02 | xAI (Grok) | Intake scout and the investigator reasoning loop. | United States |
| 03 | Exa | Web source search over the research subject. | United States |
| 04 | Parallel | Deep-research source discovery (long-running tasks). | United States |
| 05 | OpenAI | Document embeddings for primary-source retrieval. | United States |
| 06 | Browserbase | Headless capture of primary documents during the dig. | United States |
Inside the workbench, each finished Case carries a Data processing & residency panel naming the providers and regions that processed that specific run.
Infrastructure & operations¶
These providers run the workbench — hosting, storage, authentication, orchestration, monitoring, email, and billing. They handle operational data and, where applicable, content at rest under the same DPA terms.
| # | Sub-processor | Function | Region |
|---|---|---|---|
| 01 | Vercel | Application hosting, blob storage, and OG image rendering. | United States (global edge network) |
| 02 | Neon | Primary application database (Postgres). | United States |
| 03 | Clerk | Authentication and identity. | United States |
| 04 | Inngest | Research-workflow orchestration. | United States |
| 05 | Upstash | Rate-limiting cache (cross-instance request quotas). | United States |
| 06 | Sentry | Error monitoring and security alerting. | United States / European Union |
| 07 | Resend | Transactional email delivery (invites, completion notices). | United States |
| 08 | Stripe | Billing and payments. | United States |
| 09 | PostHog | Product analytics (session replay is disabled in code). | United States |
Updates and objections¶
This list is maintained as a living document. Customers on enterprise plans are notified at least thirty (30) days before a new sub-processor is added and may object as set out in the DPA. For the categories of data each sub-processor receives and the governing safeguards, see the Security overview and your DPA.
This page is informational and does not modify any contractual commitment in an order form or data processing addendum, which take precedence in the event of conflict.