Trust & security
Subprocessors
Summary
Evigate uses a deliberately small set of third-party vendors ("subprocessors") to run the service. Only Anthropic, and conditionally Google's Gemini API, ever receive customer-derived content (our AI providers), and only the minimum, and not at all when you use your own API keys (BYOK). Embeddings run entirely on our own infrastructure (self-hosted bge-large-en-v1.5), so there is no embedding subprocessor at all. This list is also served live from the application, so the published page can never drift from what the system actually uses.
Consistency note (for maintainers): this table must match
backend/app/api/public.py:_SUBPROCESSORS. The hosting subprocessor is named below as Hostinger, matching that endpoint.
1. Current subprocessors
| Subprocessor | Purpose | Data received | Location | BYOK exempt |
|---|---|---|---|---|
| Anthropic, PBC | LLM provider, drafts answers; also reads scanned questionnaire page images at intake (see §3) | A question plus the handful of retrieved evidence snippets (never whole documents), at answer time. At intake, for scanned/image PDF pages only: the page image and its extracted text | USA | Yes, your Anthropic key |
| Paddle (Paddle.com Market Ltd) | Payments, subscription billing (merchant of record) | Billing details only (handled by Paddle). No evidence or questionnaire content | United Kingdom / global | N/A |
| Hostinger | Cloud VPS hosting & self-hosted object storage, runs the app and stores data | Your data at rest (database + uploaded files) on the VPS | Mumbai, India | N/A |
Embeddings run locally. Evidence is embedded on our own infrastructure (self-hosted
bge-large-en-v1.5, viafastembed/ONNX, CPU) — chunk text is never sent to a third party to produce retrieval vectors. There is no embedding subprocessor at all, with or without BYOK.
2. What "BYOK exempt" means
When you add your own API key for Anthropic, OpenAI, Gemini, a local Ollama endpoint, or a custom OpenAI-compatible endpoint (Settings → API keys), the corresponding LLM calls run on your own provider account instead of ours. For that provider, your data then transits your account under your own agreement with that provider; Evigate is no longer the one sending it, and you bear that provider's cost. Embeddings are never BYOK — they always run on our local platform model regardless of which LLM key you supply. See the AI Usage Policy.
3. Conditional subprocessors
These are engaged only if the operator enables the corresponding feature:
| Subprocessor | When | Purpose | Data received |
|---|---|---|---|
| Google LLC — Gemini API | Only when the operator has GEMINI_API_KEY configured, and only for the specific platform-key request that failed over | Automatic LLM fallback if the Anthropic call errors | Same content as the Anthropic call for that request: a question + retrieved evidence snippets, or a scanned questionnaire page image + extracted text at intake. Organizations using their own Anthropic key never fail over to this |
| Google LLC | When "Sign in with Google" is configured (GOOGLE_CLIENT_ID/GOOGLE_CLIENT_SECRET) | Optional federated sign-in (OAuth 2.0 / OIDC) | Only for users who choose Google sign-in: their account email + Google profile id. No evidence or questionnaire content |
| [EMAIL_PROVIDER/SMTP] | When SMTP transactional email is configured | Sends verification and password-reset emails | Recipient email address + the secure link |
| Sentry | Only if error tracking (ERROR_TRACKING_DSN) is configured | Error monitoring | Error metadata and a request id; no document content or AI prompts |
If none of these features is enabled, none of these vendors receives any data. Google's Gemini API receives data only on the rare platform-key request where the Anthropic call itself errors; Google's Sign-in receives data only when a user actively chooses "Sign in with Google", never for email/password users.
4. No-training and retention
Anthropic, our primary LLM subprocessor, is engaged under a signed no-training, zero/low-retention data agreement: your content is never used to train any model and is not retained by Anthropic beyond what is needed to serve the request. Google's Gemini API, used only as the conditional fallback above, is not under a bespoke signed agreement with us the way Anthropic is; we rely instead on Google's stated terms for this API tier, under which paid-tier traffic is not used to train models — the same no-training posture, on Google's standard terms rather than a contract negotiated with us. Embeddings never leave our server, so no embedding subprocessor exists to make a no-training claim about.
5. Changes and notification
We may add or replace subprocessors as the service evolves. Material changes are reflected on this page (and the live endpoint) with a new "last updated" date and a changelog entry. Customers under the DPA may request advance notice of new subprocessors that would process Customer Content and may object on reasonable data-protection grounds.
6. Contact
Questions about subprocessors or data flows: privacy@logethos.com. See the Security Overview and Privacy Policy.
*Effective date: July 31, 2026 · Last updated: 2026-07-21 · Version 1.1*