Sub-processors, ISMS Copilot Partner Embed

Effective Date: 2026-07-22.

This list discloses the sub-processors ISMS Copilot (Better ISMS) engages to provide the Partner Embed. In the embed, the Partner is the Controller of its end-users' personal data and ISMS Copilot is the Processor; the entities below that process end-user personal data are sub-processors.

Scope. This list covers the Partner Embed program only, and is distinct from the sub-processors for the ISMS Copilot chat product shown on the trust center home page. One entity (Stripe) is listed for completeness as the partner-billing vendor: it processes the Partner's own billing data, not end-user personal data, and is not an Art. 28 sub-processor of end-user data.

Partners should reflect the applicable end-user-data sub-processors (by tier) in their own end-user privacy notice; the statutory Art. 13/14 disclosure is by recipient category, the third country, and the transfer safeguard, with recipient identities disclosed where the Partner's transparency approach or its own contracts require. See the Partner DPA (§3.3, §4, §6.4) for the governing data-protection terms and the Partner Terms of Service (§5) for the model-origin acknowledgment.

Infrastructure and observability sub-processors (all embed traffic)

AI model sub-processors (by embed tier)

The AI provider that processes an end-user's prompt depends on the Partner's tier. Tier change equals sub-processor change. (Moderation via Mistral, above, runs on every tier regardless.)

Economy-tier routing

The economy tier resolves to a dedicated partner_economy OpenRouter policy that pins a closed non-PRC provider set:

PROVIDER_PARTNER_ECONOMY = {
  order: ["cerebras", "google-vertex"], only: ["cerebras", "google-vertex"],
  allow_fallbacks: true, data_collection: "deny", zdr: true,
}

The provider set is deterministic and reviewable in code (it pins the providers, not the per-request region: OpenRouter does not pin region, and the google-vertex slug spans regions, so the underlying-provider SCCs remain the operative transfer safeguard). It is layered on the OpenRouter account-level controls (mandatory ZDR, training-disallowed, publication-disallowed, closed allowlist, PRC-blocklist). Prompts can only reach Cerebras (US) or Google Vertex (US or another non-PRC region); the only list and the account-level PRC-blocklist both exclude the model's first-party PRC endpoint (a blocked host) and any other non-allowlisted provider. data_collection:"deny" and zdr:true reinforce, in the request itself, the account-level zero-retention posture (no persistent retention beyond serving the request; transient in-memory caching only), and no training. On the partner backend (APP_MODE=partner) all economy traffic uses this policy, which is the same routing posture as the chat product's Essential tier (Google Vertex + Cerebras subset).

Scope note (not overstated): this is a closed non-PRC set, not a strict US-region pin. The base google-vertex slug spans all Vertex regions (Cerebras is US). The China transfer is what the closed set eliminates; US-versus-EU inference sits under the general SCC framing.

Premium-tier routing

The premium tiers (Growth, Scale, Enterprise, non-ADP) route the GLM-5.2 primary (z-ai/glm-5.2) through a dedicated premium OpenRouter provider policy that, exactly like the economy policy, pins a closed non-PRC provider set in code (Together AI, Fireworks AI, DeepInfra; all United States) and is layered on the OpenRouter account-level controls (mandatory ZDR, training-disallowed, publication-disallowed, closed allowlist, PRC-blocklist), with data_collection:"deny" and zdr:true reinforced in the request. GLM-5.2 prompts can only reach Together AI (US), Fireworks AI (US), or DeepInfra (US); the pinned only set and the account-level PRC-blocklist both exclude the model's first-party PRC endpoint and any non-allowlisted provider, so premium prompts, like economy prompts, do not reach a PRC endpoint. These three hosts are also disclosed OpenRouter underlying providers of the ISMS Copilot chat product, under the same account-level posture.

Where the GLM-5.2 primary is unavailable, the request fails over before any output token is streamed to Anthropic (US) (a direct leg under SCCs Module Three, on Anthropic's standard commercial retention, which is not zero-retention), and, if Anthropic is also unavailable, to Mistral (EU, zero-retention) as the deeper circuit-breaker failover. As with the economy tier, the pinned provider set is deterministic and reviewable in code (it pins the providers, not the per-request region: OpenRouter does not pin region), so the underlying-provider SCCs remain the operative transfer safeguard for the GLM-5.2 hosts. The premium primary is a Chinese-authored open-weights model; the model-origin acknowledgment (DPA §3.3, ToS §5) therefore applies to the premium tiers as well as the economy tiers.

Economy and premium tiers: no PRC-hosted inference

End-users' prompts on the economy and premium tiers (both served by a Chinese-authored open-weights model, GLM-4.7 and GLM-5.2 respectively) do not reach a PRC endpoint. Provider selection is enforced by the account-level ban on China-hosted inference (a jurisdiction-based, Schrems II-style supplementary measure) and the code pin to a closed non-PRC host set (economy: Cerebras / Google Vertex; premium: Together AI / Fireworks AI / DeepInfra); no first-party PRC endpoint is reached. As the chat trust center frames the same control, this is a selection based on the providers' documented footprint and the account-level blocklist, not an absolute per-request region guarantee: OpenRouter does not pin the per-request inference region, and the google-vertex slug spans non-PRC regions. The data-path sub-processors are the US entities listed above, under SCCs (with EU-US DPF adequacy, Art. 45, as an additional basis for Google Vertex, the certified entity being Google LLC). The Anthropic (US) premium fallback is a separate direct US leg under SCCs Module Three (not zero-retention).

Partners with model-sourcing restrictions in their own contracts or internal policies should review the applicable contractual terms in the Partner DPA (§3.3) and Partner ToS (§5). Because both the economy and premium primary models are Chinese-authored, a Partner that will not accept a Chinese-authored model on the data path cannot escape it by switching between the economy and premium tiers: its route is the ADP (Mistral, EU) tier (available on Growth and above, so a Free or Starter Partner takes a paid upgrade to reach it), or contracting the Anthropic (US) path as the primary in an order form. The Partner's own end-user notice must reflect the applicable data-path sub-processors, third country, and transfer mechanism by tier (DPA §6.4).

Not sub-processors of end-user data (V1 configuration)

These are version-dependent statements tied to the V1 configuration and change control, not permanent guarantees; a route or feature change updates this list.

• Email (SendGrid / Twilio): the embed sends no end-user email; SendGrid touches only main-product account email.
• OpenAI: present in the codebase but the embed never routes to it.
• Cortecs (EU-sovereign): wired but dormant; no partner tier emits its route token.
• Document-generation processors (document conversion, Mistral Codestral): the base chat pipeline can send generated content to these when producing a downloadable document, but document generation is not enabled on the partner embed in V1 (partner replies never run detection or generation), so no partner end-user content reaches them. They will be added here if and when partner document generation ships. Content moderation via Mistral AI SAS (EU) runs on every tier and IS listed above.

Change notification

Routing within the disclosed envelope is control-neutral: no advance notice, publication-only (DPA §3.2). ISMS Copilot may route or switch the Partner's AI traffic among the disclosed destinations in this list (the OpenRouter allowlist and its non-PRC hosts, Anthropic, and Mistral (EU)) and move a tier or cohort between them over time without advance notice, so long as no applicable retention, training, publication, security, transfer, or jurisdiction control is materially weakened, reflecting the change here and in the trust center. A sustained re-designation of a premium tier's primary from a zero-retention model to Anthropic's standard commercial retention is treated as a material control change (30-day advance notice plus the objection-and-termination remedy), not as control-neutral (DPA §3.2). The fixed commitments are that end-user prompts are never routed to a PRC endpoint and that a selected EU / ADP (Mistral, EU) path stays EU.

Only a genuinely new sub-processor (one not already on this list) or a material control change (one that materially weakens the retention, training, publication, security, transfer, or jurisdiction controls, or expands the categories of personal data processed) is announced via the partner console and reflected here at least 30 days before it takes effect, per DPA §3.2, with the objection-and-termination remedy. For an urgent security-driven replacement ISMS Copilot may act on shorter notice, but will notify promptly with reasons and preserve the DPA §3.2 objection-and-termination remedy. Partners may object per DPA §3.2 (during the notice period, or at any time for a control-neutral change published without an advance notice period).

Notes

• Premium tier (GLM-5.2 primary + Anthropic fallback). The premium primary is GLM-5.2 (z-ai/glm-5.2), an open-weights Chinese-authored model served on the closed non-PRC host set (Together AI, Fireworks AI, DeepInfra; US) via OpenRouter under the account-level ZDR / training-disallowed / allowlist / PRC-blocklist controls (zero-retention, no training). Anthropic, PBC (US) is the pre-first-token fallback: the embed calls api.anthropic.com directly, the same path for EU and non-EU partners, stated conservatively as a US transfer under SCCs Module Three, with Anthropic's standard commercial retention (ordinary deletion up to ~30 days; safety-flagged content up to 2 years; safety-classification scores up to 7 years; no training; not zero-retention). Mistral (EU, zero-retention) is the deeper circuit-breaker failover. The premium GLM-5.2 hosts are also disclosed OpenRouter underlying providers of the chat product.
• Economy tier. The data-path transfer to the PRC is closed (non-PRC only set, account-level PRC-blocklist, and request-level zero-retention). The US inference leg (OpenRouter, Cerebras, Google Vertex) is under SCCs at the provider layer with a concluded transfer impact assessment (DPA §4.2).
• Google Vertex DPF. The DPF-certified entity is Google LLC (Active on the EU-US Data Privacy Framework participant list, covering Google LLC and its wholly-owned US subsidiaries, with Google Cloud Platform among the covered services). The Vertex leg rests primarily on SCCs Module Three (the primary, independent Art. 46 basis), with EU-US DPF (Art. 45 adequacy) as an additional basis where in force; the DPF status is kept under a monthly monitoring commitment, and if the adequacy decision were suspended the SCCs stand alone.
• Art. 28(2)/(4). Pass-through disclosure of the AI sub-processors is necessary but not sufficient; the DPA contains the Art. 28(4) flow-down obligation (§3.4) and, for the US inference leg, the concluded TIA (§4.2). The flow-down and SCC chain runs to non-PRC US hosts, not a PRC endpoint.
• ADP tier residency. EU for storage, inference, and content moderation (Mistral FR, Supabase EU region, Fly cdg, Sentry EU ingest). It is not literally EU end-to-end, because Supabase, Fly, Vercel, and Axiom are US-incorporated (electronic-access transfer risk) and Axiom (US) receives Fly logs containing end-user pseudonymous identifiers; those infrastructure providers process under SCCs, and no non-EU AI model provider is on the ADP path.

This Partner Embed Sub-processor List is published by Better ISMS (ISMS Copilot). Data-protection questions: privacy@ismscopilot.com.