Sub-processors
Every organisation that receives personal data in the course of running NACRE Intel, what they receive it for, and where they are. This list is part of the Data Processing Agreement: customers are notified before anyone is added, and may object.
Where data is held
All account and investigation data is stored in Frankfurt, Germany. Nothing is stored outside the European Union. Transfers listed below are transfers of data for processing — principally sending a subject’s name and retrieved page content to a language model — not storage elsewhere.
Current sub-processors
| Organisation | What it does | What it receives | Where | Transfer basis |
|---|---|---|---|---|
| Anthropic PBC | Language model inference: analysis, synthesis and portrait verification | Subject name and context, retrieved page content, findings | United States | EU Standard Contractual Clauses, via Anthropic’s Data Processing Addendum |
| Akamai Technologies (Linode) | Hosting, database and file storage | All account and investigation data at rest | Frankfurt, Germany | None — data remains in the EU |
| OpenSanctions | Sanctions, PEP and watchlist screening | Subject name and, where known, country | Germany | None — data remains in the EU |
| OpenCorporates | Corporate registry and directorship screening | Subject name and, where known, jurisdiction | United Kingdom | UK adequacy decision |
| Open Ownership | Beneficial ownership screening | Subject name | United Kingdom | UK adequacy decision |
| Internet Archive | Archiving source pages so cited evidence remains verifiable | URLs of pages cited in a dossier | United States | EU Standard Contractual Clauses |
| Wikimedia Foundation | Portrait lookup for public figures (Wikidata, Wikimedia Commons) | Subject name | United States | EU Standard Contractual Clauses |
| unavatar.io | Resolving a public avatar from a social handle already found | A public social handle | European Union | None — data remains in the EU |
Sources that are read, but are not sub-processors
In the course of an investigation the service also requests ordinary public web pages — a company’s own site, a news article, a public register, a professional profile. Those requests reveal that a page has been fetched, but no personal data about the subject is supplied to them beyond what is in the URL. They are not sub-processors and are not listed individually.
Model training
Our language model provider does not train its models on the content we send. That is a contractual commitment in the agreement between us, not a setting we rely on.
Changes to this list
We will give customers at least thirty days’ notice by email before a new sub-processor begins processing, and a customer who reasonably objects on data protection grounds may terminate for the affected part of the service and receive a refund of unused credits.