Sub-processors. Who processes data for us.
The companies that process personal data for Rapid Review, Inc. when it provides Rapid Review. Last updated 12 November 2026.
01
The list.
| Company | What it does | Data it handles | Where |
|---|---|---|---|
| Amazon Web Services, Inc. | Amazon Bedrock: runs AI models for reviews directly, in place of OpenRouter, for the models we send there | Repository content in review requests | USA or the EU, by the AWS region we use |
| Anthropic, PBC | Claude models: reviews, checking findings, drafting support replies, and the app’s assistant’s answers and the tickets it writes | Repository content in review requests; support mail, with the account facts a draft needs; questions to the app’s assistant, with their conversations and account facts | USA |
| Apple Inc. | Apple Push Notification service: delivers to our team’s iPhones the notifications of each new sign-up | A notification’s first lines: the GitHub login of a person who signs up | USA |
| Cloudflare, Inc. | Hosts the website, the app, the GitHub App, the support desk and our push service, their databases and storage; receives and sends support mail; Turnstile on the contact form and on the app’s code form | All of it: repository content, accounts, support mail, the assistant’s conversations | USA, and Cloudflare’s data centers worldwide |
| Inception Labs, Inc. | Mercury model: checking findings | Repository content in review requests | USA |
| OpenAI, L.L.C. | A model that reviews when the main one isn’t available | Repository content in review requests | USA |
| OpenRouter, Inc. | Passes requests to the AI model providers on this list, only to those that do not train on the data | Repository content in review requests; support mail, with the account facts a draft needs; questions to the app’s assistant, with their conversations and account facts | USA |
| Stripe, Inc. | Payments, invoices and the billing portal | Billing contacts and payment data | USA |
| TypeSafe AI, Inc. | Jev model: rating findings, sorting support mail, reading open-source applications, checking the app’s assistant’s answers | Repository content in review requests; support mail; questions to the app’s assistant, with their answers, conversations and account facts | USA |
| Voyage AI (MongoDB, Inc.) | Embeddings of changed code, to match it with published security advisories | Repository content | USA |
OpenRouter may run a model through more than one provider that hosts it, such as the model’s maker, Amazon Web Services or Google Cloud. It sends requests only to providers that do not train on them.
GitHub isn’t on this list: it is the customer’s own platform, under the customer’s agreement with GitHub.
02
Changes.
We announce a new sub-processor on this page at least 30 days before it processes customer personal data, as the Data Processing Addendum describes. To object, write to privacy@rapidreview.dev.