Plain-English Summary
AI Cred uses subprocessors to run the product. Customer and cohort data may be sent to infrastructure, payment, email, bot-protection, consented analytics and ad attribution, and AI inference providers as needed to provide the service.
AI Cred does not intentionally train its own foundation models on customer or cohort data. AI Cred currently uses Anthropic commercial API services as its only AI model provider for the application. Anthropic states that commercial offering data is not used to train models unless the customer opts in or explicitly submits materials for model improvement.
AI Cred does not currently use OpenAI, Google/Gemini, Vercel AI Gateway, or Pinecone for production AI inference, embeddings, RAG, or vector storage. Pinecone is not a current AI Cred subprocessor.
AI Cred relies on vendor commercial terms, privacy terms, and data processing terms where available. Vendor relationships are not described as custom enterprise agreements unless a specific executed agreement is confirmed for that vendor.
Subprocessor Register
Six columns: scroll the table sideways to read them all.
| Provider | Purpose | Data processed | Region | Status | AI training use |
|---|---|---|---|---|---|
| Supabase | Database, authentication, storage, Row Level Security, Edge Functions, and backups. | Account data, profile data, assessment and learning data, team data, payment metadata, logs, security events, and file uploads. | United States and vendor-operated regions. | Active | Not an AI model provider for AI Cred assessment inference. |
| Vercel | Application hosting, deployments, environment configuration, logs, and analytics. | Request metadata, app logs, frontend assets, and environment variables. | Global edge network and United States. | Active | Not an AI model provider for AI Cred assessment inference. |
| TikTok | Consented ad attribution and analytics for campaign performance measurement. | Page events, IP address, browser/device metadata, and TikTok pixel cookie identifiers when optional cookies are accepted. | United States and vendor-operated global infrastructure. | Active only with consent | Not an AI model provider for AI Cred assessment inference. |
| Stripe | Hosted Checkout, payment processing, subscriptions, refunds, webhooks, and payment metadata. | Customer email/name, Stripe customer/session/subscription IDs, purchase and refund metadata. Raw card data is handled by Stripe, not AI Cred. | United States and vendor-operated regions. | Active | Not an AI model provider for AI Cred assessment inference. |
| Anthropic | AI inference for current core assessment, scoring, and learning workflows. | Assessment conversation content, user prompts, context fields included in prompts, AI outputs, and usage metadata. | United States and vendor-operated regions. | Active | Anthropic states that commercial offerings such as the Anthropic API are not used to train models unless the customer opts in or explicitly submits feedback/materials for model improvement. |
| Resend | Transactional, support, and notification email delivery and webhooks. | Email addresses, names where included, message content, and email delivery/open/click metadata. | United States and vendor-operated regions. | Active | Not an AI model provider for AI Cred assessment inference. |
| Upstash | Redis-backed rate limiting for signup, checkout, and partner/API flows. | Rate-limit identifiers such as IP/user/action scoped keys and timestamps. | Vendor-operated regions when configured. | Active when configured | Not an AI model provider for AI Cred assessment inference. |
| reCAPTCHA | Human/bot verification for signup and checkout flows when Google reCAPTCHA is configured. | CAPTCHA tokens, IP address if sent to the provider, and client-side interaction signals. | Google-operated global infrastructure when configured. | Active when configured | Not an AI model provider for AI Cred assessment inference. |
| hCaptcha | Human/bot verification for signup and checkout flows when hCaptcha is configured. | CAPTCHA tokens, IP address if sent to the provider, and client-side interaction signals. | hCaptcha-operated global infrastructure when configured. | Active when configured | Not an AI model provider for AI Cred assessment inference. |
Notes for Legal and Procurement Review
AI Cred is a small, founder-operated platform and is not currently claiming SOC 2, ISO 27001, HIPAA, FedRAMP, or custom enterprise contracting coverage unless separately provided in writing.
If a customer needs a signed DPA, subprocessor notice terms, or vendor-specific evidence, contact help@aicred.ai. We can review the requested cohort, confirm which integrations are active for that cohort, and provide the most relevant vendor links or documents.
Related legal and implementation pages: Terms of service, Privacy policy, and Verified docs.