AskVault sub-processors
Sub-processor categories
A sub-processor is a third party that processes customer data on AskVault's behalf. We use a small set, organized into these categories:
- Database and vector storage. Holds workspace content, embeddings, conversations, audit logs.
- Application compute. Runs the AskVault application servers and background workers.
- Edge, DDoS, and DNS. Terminates TLS, mitigates DDoS, routes traffic to our region.
- LLM providers. Used per-query for the generation step in retrieval-augmented answers.
- Email and notification delivery. Transactional emails (password reset, account confirmation, alerts).
- Payment processing. Subscription billing. We never see card details; the payment processor handles PCI scope.
- Speech-to-text. Transcribes phone-channel calls and, where switched on, WhatsApp voice notes. Voice-note audio is sent for transcription only; AskVault doesn't store it.
- Text-to-speech. Speaks the agent's replies on phone calls.
- Telephony, SMS and messaging platforms. Carry messages and calls on the channels you connect (for example WhatsApp, Telegram, SMS and phone numbers).
- Cache and job queue. Holds indexing jobs and live-chat events in transit.
- Browser rendering. Loads pages that need a real browser while your site is crawled.
- Embeddings. Turns your content and each question into vectors for search.
- Error monitoring. Receives error reports from the application, with credentials removed.
- Product analytics. Usage analytics for our own website and dashboard, hosted in the EU.
Each category has a single primary provider plus optional fallbacks for resilience.
Why we don't publish specific provider names publicly
Two reasons:
- Competitive surface area. Publicly advertising our exact stack helps competitors copy our architecture without investment. We prefer to discuss specifics under NDA.
- The list is available on request. Our database provider holds a SOC 2 Type II report and encrypts at rest with AES-256, and every provider is reached over TLS. Procurement teams that need each provider's name and role can have the full list.
Procurement teams that need the full list for vendor management can get it under NDA. Email [email protected] with your point of contact and timeline.
Where data flows
For a typical AskVault customer query:
- Visitor message arrives at our edge provider, terminates TLS, forwards to application compute.
- Application compute authenticates, validates, and forwards to our database for retrieval.
- Database returns matching content chunks based on vector similarity.
- Application compute assembles a prompt with the retrieved chunks plus the question, sends to an LLM provider.
- LLM provider generates the response, returns to application compute.
- Application compute assembles the final response with citations, returns through the edge to the visitor.
Total data flow: edge -> compute -> database -> compute -> LLM -> compute -> edge -> visitor. All encrypted in transit with TLS 1.2 or higher.
LLM provider handling
LLM providers are the most-asked-about sub-processor category. Three things to know:
- No training by AskVault. AskVault does not use your content or conversations to train models. Whether a provider may use API traffic for its own training is set by that provider's terms.
- Per-query routing. Each query may route to a different LLM provider depending on plan tier, query type, and provider availability. The relationship is per-query, not per-customer.
- Provider retention. How long a model provider keeps prompts and responses is set by that provider's own terms, which differ between providers and between free and paid tiers. Email [email protected] for the terms that apply to the model your workspace uses.
Geographic data flow
Customer data flows through:
- Primary processing region. United States. The application and its primary data store both run there.
- LLM provider region. Depends on the provider and model. Data crosses regions for the inference step. How long a provider keeps prompts and responses is set by that provider's own terms (see the provider retention note above).
- Edge region. Distributed globally via our edge provider's POPs.
- Product analytics. EU.
Change notification process
Per our DPA, AskVault notifies customers 30 days in advance when:
- A sub-processor is added.
- A sub-processor is removed.
- A sub-processor's scope changes materially (e.g., we expand the LLM provider relationship to include training).
Notification methods:
- Email to the workspace owner's account email. That is the only notice channel.
Customers can object to a sub-processor change. If we cannot resolve the objection within 30 days, you can terminate the affected workspace with data export per our DPA.
Audit reports per sub-processor
Audit reports belong to each provider, and most providers share them only through their own trust centers. Once you have the list, your team can request reports directly. The one most reviewers ask for is the database provider's SOC 2 Type II report, which covers storage encryption, access controls and availability.
How customer data is segregated
Within each sub-processor, AskVault's data is segregated from any other tenant data the sub-processor handles. Database tenancy: multi-tenant on a shared instance with workspace-level partitioning, on every plan. There is no dedicated database for any plan. Compute: per-process isolation; no shared memory across customer requests.
Common questions
Do customer logos show up on the sub-processor's marketing pages?
No. AskVault doesn't share customer information with sub-processors beyond what's required for the service. Customer logos and case studies require explicit customer permission and don't flow through sub-processors.
Are PHI sub-processors covered under a HIPAA BAA?
No. AskVault does not currently sign Business Associate Agreements (BAAs) on any plan, and AskVault is not HIPAA compliant, so no BAA covers your data at AskVault or at its sub-processors. Do not upload, collect, or send protected health information (PHI) through AskVault. See HIPAA at AskVault.
Can I exclude a specific sub-processor?
For most customers, no. The sub-processor stack is integrated and per-customer exclusion isn't feasible. Enterprise contracts can request specific sub-processor exclusions; we evaluate case by case.
What happens if a sub-processor has a security incident?
AskVault's incident response runbook activates. Affected customers are notified without undue delay, consistent with our GDPR and DPA obligations. Post-incident review is shared on Enterprise plans.
How often does the sub-processor list change?
Rarely. Each change goes through the 30-day notification process.