About this list
WYRM Sentinel uses third-party sub-processors to deliver the service. The list below covers infrastructure, AI model providers, communications, payments, data feeds, and operational tooling. We update this list when sub-processors are added, removed, or materially changed.
Customers under a written agreement that incorporates a Data Processing Addendum (DPA) will receive at least thirty days' prior notice of material changes to this list, with the right to object as set out in the DPA.
Infrastructure
Vercel Inc.
Frontend hosting, edge delivery, CDN.
Railway Corp.
Backend API hosting (FastAPI services).
Supabase Inc.
Managed Postgres database, authentication, object storage. Underlying infrastructure: AWS.
Cloudflare, Inc.
DNS, edge protection, WAF, DDoS mitigation.
Upstash, Inc.
Serverless Redis for webhook deduplication and rate limiting.
AI / model
Anthropic, PBC
Large language model API (agentic decisioning, drafting).
OpenAI, OpC.
Large language model API (used as fallback or for specialist agents only — not for default routing).
Communications
Resend.com
Transactional email delivery (verification, RFQ emails, notifications).
Payments
Lemon Squeezy (Affirm Inc.)
Subscription billing, card payment processing, tax handling.
Data feed
OpenSanctions Datenbanken Ltd
Consolidated sanctions registry data.
Freightos Ltd
Freight rate estimation, CO₂ calculation, and (when activated) end-to-end freight booking.
AISStream
Real-time AIS maritime tracking data feed.
HM Revenue & Customs (HMRC)
UK Trade Tariff data feed (public).
Operations
GitHub, Inc.
Source code hosting, CI/CD workflows.
Plausible Insights OÜ
Privacy-respecting product analytics on the public marketing site.
Data residency
Buyer data is stored in the Supabase project region selected at on-boarding. Where data is processed by sub-processors outside the United Kingdom, transfers are made under the International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an equivalent transfer mechanism documented in our DPA.
Notifications and contact
To receive change notifications by email, contact trust@wyrm.ai. For DPA, security questionnaires (CAIQ, SIG), and sub-processor due-diligence packs, see Trust.