Sub-Processor List

Last Updated: April 30, 2026 Version: 1.0

Overview

This page lists the third-party sub-processors that Ridgecrest Works LLC ("we," "Denouement") engages to process personal data on behalf of planners who use the Denouement Platform. Each sub-processor is bound by a data processing agreement with obligations no less protective than those in our Data Processing Agreement.

This list is referenced by our Data Processing Agreement, Privacy Policy, and AI Disclosure Policy.

Current Sub-Processors

| Sub-Processor | Purpose | Data Categories | Region | Contractual Safeguards | |---|---|---|---|---| | Vercel Inc. | Application hosting and content delivery | IP addresses, request metadata, session tokens | United States (global edge) | Vercel DPA; data encrypted in transit (TLS 1.2+) and at rest | | Supabase Inc. | Database (PostgreSQL), file storage, authentication | Account information, uploaded documents, event data, authentication credentials | United States | Supabase DPA; row-level security enforced; encryption at rest (AES-256) and in transit | | Anthropic PBC | Large language model inference for AI features (contract intelligence, payment extraction, workflow automation) | Document content submitted to AI features (contracts, event details); no persistent storage by provider | United States | Enterprise agreement (pending); contractual prohibition on using customer data for model training | | Stripe Inc. | Payment processing and metered billing | Billing contact information, subscription and usage data; Denouement does not store payment card numbers | United States | Stripe DPA; PCI DSS Level 1 certified | | Google LLC | Google Drive integration (document import) | OAuth tokens, file metadata, document content selected by planner for import | United States | Google Workspace API Terms of Service; OAuth scopes limited to user-selected files | | Resend Inc. | Transactional email delivery (account notices, event communications, signature requests) and inbound email ingestion (parsing replies and attachments routed to a Denouement webhook) | Recipient/sender email addresses, names, email content, attachments for inbound replies | United States | Resend DPA; email content encrypted in transit; webhook signature verification (Svix) enforced | | Twilio Inc. | SMS notifications (payment reminders, event updates) | Recipient phone numbers, message content | United States | Twilio DPA; SOC 2 Type II certified | | BEM AI | Document extraction and content analysis | Uploaded document content (contracts, invoices) | United States | BEM AI data processing terms; no use of customer data for model training | | Upstash Inc. | Serverless rate limiting (Redis) | IP addresses, request metadata (no document or account content) | United States | Upstash DPA; data encrypted at rest and in transit |

Notification of Changes

We will provide at least 30 days' advance written notice before engaging a new sub-processor or materially changing the role of an existing sub-processor. Notice will be provided by email to the account holder and by updating this page.

If you object to a new or changed sub-processor, you may notify us in writing at legal@denouement.ai within the notice period. If we cannot reasonably accommodate your objection, you may terminate the Data Processing Agreement on 30 days' written notice as described in the DPA.

How to Subscribe to Updates

To receive email notification of sub-processor changes, ensure your account email is current in your Denouement account settings. You may also contact legal@denouement.ai to be added to the sub-processor notification list.

Contact

For questions about our sub-processors or data processing practices:

Ridgecrest Works LLC — Legal Email: legal@denouement.ai