Sub-processors

This page lists the third-party sub-processors that 5CEOs engages in the course of providing the 5CEOs Service. The Data Processing Addendum and the GDPR Art. 28 addendum incorporate this list by reference. 5CEOs will provide at least thirty (30) days' notice of any addition or replacement by updating this page (and, for Compliance and Enterprise customers, by email).

Current sub-processors

• Amazon Web Services, Inc. (headquartered in the United States; default region us-east-1) — hosts the gateway, the inference substrate, and the audit log. All Customer prompts and Outputs are Processed within AWS infrastructure under 5CEOs's account; the inference substrate is bound to the loopback interface and reachable only by the gateway. Enterprise customers may select an alternative region.
• Brave Software, Inc. (headquartered in the United States) — operates the third-party live web search provider used as a fallback grounding source when our substrate cannot resolve a Customer query from training. The Customer's query text is transmitted to the search provider in order to retrieve grounding sources; the provider's response (links and snippets) is then used as context for the Customer's Output. No Customer identity, API key, or other Customer metadata is transmitted to the search provider.
• Resend, Inc. (headquartered in the United States) — delivers transactional email (welcome messages, API-key issuance receipts, billing notifications) to the Customer's verified email address. No Customer prompt, response, or substrate output is transmitted to the email provider.
• Stripe, Inc. (headquartered in the United States) — processes subscription payments and stores billing details. Customer-prompt content is never transmitted to Stripe. Stripe's processing is governed by its own Data Processing Addendum, available at stripe.com/legal/dpa.
• OpenTimestamps calendar pool (independent volunteer operators including Catallaxy and Eternity Wall, various jurisdictions) — receive opaque SHA-256 hashes of the gateway's append-only audit-chain checkpoint state for the purpose of anchoring the chain head to the Bitcoin blockchain via the open OpenTimestamps protocol (opentimestamps.org). The hash transmitted is one-way and contains no Customer prompt, response, identity, or other Customer metadata; the anchored timestamp is publicly verifiable by any party using the open-source ots CLI without contacting 5CEOs's infrastructure. This sub-processor relationship is provided as a transparency mechanism: any Customer can prove that audit-chain state existed at a given Bitcoin block height without relying on 5CEOs to attest to it.
• GitHub, Inc. (a subsidiary of Microsoft Corporation, headquartered in the United States) — hosts the open-source determinism bench (github.com/5CEOS-DRA/llm-determinism-bench) and the public artifacts published by 5CEOs. No Customer prompt or response content is published to GitHub.

Conditional sub-processors not currently active in production:

• A CRM-relay webhook (subscription state changes POSTed to a Customer-relationship-management endpoint) is supported by the gateway code but is not configured in the current production deployment. If it is configured in the future, the recipient will be added to the active sub-processor list above with thirty (30) days' written notice before the data flow begins.

Change history

Material changes to this list will be timestamped here.

• 2026-05-12 — initial publication.

Questions

Sub-processor questions: support@5ceos.com.