These are the third parties we use to run Axiom. For each one: what it does, what data reaches it, and where it processes. Nothing outside this list receives your documents.
We add a subprocessor to this page before it is switched on, not after, and we give at least 30 days' notice to customers with an active plan before a new one begins processing Customer Data. To be notified of changes, write to privacy@axiomvouch.com.
Each subprocessor is engaged under a written contract that limits it to processing on our instructions, requires appropriate security measures, and — for the AI providers — prohibits the use of your content to train or improve their models. See our privacy policy for how this fits the rest of our data handling.
United States
Reads uploaded contracts and remittance documents and extracts their terms into a structured form. Our default provider.
Receives: Text extracted from uploaded documents, sent for processing and returned. Not retained for training.
United States
Alternative model provider for document reading and term extraction, used where it performs better on a document type.
Receives: Text extracted from uploaded documents, sent for processing and returned. Not retained for training.
United States
Alternative model provider for document reading and term extraction, used where it performs better on a document type.
Receives: Text extracted from uploaded documents, sent for processing and returned. Not retained for training.
United States
Database, authentication, and private file storage. The system of record for everything in your account.
Receives: Account credentials, organisation profiles, uploaded documents, findings, workpapers, disputes, ledger records, and the activity trail.
United States, with a global edge network for static content
Application hosting and content delivery. Serves the site and runs the application's server-side code.
Receives: Request data in transit, including IP address and request headers. Uploaded documents pass through in transit but are not stored here.
United States
Sends transactional email — results notifications, security alerts, password resets, and account email.
Receives: Recipient email address, and the content of the message we send you. Findings and documents are not attached to email.
Does not receive uploaded documents or their contents.
United States
Error monitoring. Receives a diagnostic report when something in the application fails, so it can be fixed.
Receives: Error details, stack traces, and limited request context. Configured to avoid capturing document contents.
Does not receive uploaded documents or their contents.
Our engine can technically speak to model providers we do not use for your data. Any provider not named above is refused in our production environment — the run fails rather than quietly falling back to it. A provider is added here, with notice, before that ever changes.
We run no advertising network, no analytics provider, and no marketing or session-replay tracker on this site. There is nothing of that kind to list.
Additions and removals, so this list can be audited rather than just read.
First published register: Supabase, Vercel, Anthropic, Google, OpenAI, Resend, and Sentry.