Subprocessors
Last updated: October 3, 2026
RiskWise (operated by JOOP LLC) uses the following third-party service providers ("subprocessors") to help us provide, maintain, and improve our services. Each subprocessor processes data only as necessary to perform its designated function. We review our subprocessors periodically and will update this page when changes occur.
| Subprocessor | Purpose | Data Processed | Location | Security Certifications |
|---|---|---|---|---|
| Supabase | Database hosting, authentication, and file storage | Account data, uploaded documents, analysis results | United States | SOC 2 Type II |
| Vercel | Application hosting and edge delivery | Web traffic, server-side rendering | United States | SOC 2 Type II |
| Anthropic (Claude API) | AI reading of uploaded documents and the AskRW assistant | Text of uploaded contracts and insurance documents, and the questions users ask AskRW. Some PDFs and photos go as files, for example a certificate or training card photographed in the app or a letter from an insurance carrier. Data is not used to train models under Anthropic API usage policy. | United States | SOC 2 Type II |
| OpenAI | Text embeddings for search and similarity features only | Document text for vector embedding generation. Data is not used to train models under OpenAI API data usage policy. | United States | SOC 2 Type II |
| Modal | Reading the text out of uploaded PDFs, and drawing page previews of document templates | Uploaded contract and insurance PDFs, which Modal downloads through a link that expires after one hour. The text it reads comes back to RiskWise. Template previews use sample data only. | United States | SOC 2 Type II |
| Stripe | Payment processing and subscription billing | Payment method details, billing information | United States | PCI DSS Level 1 |
| Resend | Sending transactional email, and receiving email sent to RiskWise inbound addresses (insurance agency inboxes and RiskWise Managed client inboxes) | Email addresses and email content. Inbound mail arrives whole, with its attachments. For Managed clients that can include employee paperwork such as driver's licenses and I-9 forms. | United States | SOC 2 Type II |
| Slack | Internal notices to RiskWise staff about client documents that arrive by email | Which client a document came from, its type and size, its file name with long numbers masked, and whether the sender is on the client's team. When a team member sent it, a short preview of their message may be included. The documents themselves are not posted. | United States | SOC 2 Type II, ISO 27001 |
| Telnyx | SMS message delivery | Phone numbers, SMS message content | United States | SOC 2 Type II |
| Cloudflare | DNS management and email routing | DNS queries, email routing metadata | United States | SOC 2 Type II, ISO 27001 |
| Upstash | Rate limiting and caching (Redis) | Request metadata (IP addresses, rate limit counters) | United States | SOC 2 Type II |
| Sentry | Error monitoring and performance tracking | Error logs, stack traces, browser metadata, IP addresses | United States | SOC 2 Type II |
If you have questions about our subprocessors or data processing practices, contact us at Hello@GetRiskWise.com. For how customer data is processed, see our Data Processing page and our Terms of Service.