Norcaster · Trust center
Subprocessors
Infrastructure and service providers Norcaster uses to operate the platform, plus customer-configured model providers.
When you connect external model or embedding providers, those vendors process prompts and outputs according to your configuration. Norcaster records policy decisions and traces; raw prompts are not required in enforcement audit rows.
Version 2 · effective 2026-10-13 · registry hash a25e1fa46d02…
This list updates automatically when our internal sub-processor registry changes and is published to the site. Machine-readable JSON: /subprocessors.json · API
| Party | Role | Regions | Data categories | Notes |
|---|---|---|---|---|
| Source code hosting and CI | US, EU | source_code, ci_metadata | — | |
| Cloud infrastructure (managed Norcaster hosting) | EU | customer_payloads, operational_logs, account_metadata | The production cluster runs in Hetzner's Nuremberg, Germany site. | |
Model providers you configure Customer-configured | Inference (OpenAI, Anthropic, Azure OpenAI, Bedrock, etc.) | varies | prompts, completions, embeddings | Customer-selected; data flows per deployment provider binding and DPA. |
| Secondary blockchain timestamp for trace chain Merkle roots | global | sha256_merkle_root_digests | Optional redundancy alongside Rekor; digest-only submissions. | |
| Transparency log for trace chain Merkle roots (hashedrekord; digest only) | US, EU | sha256_merkle_root_digests | Trace chain anchoring (from the Growth plan up) when TRACE_CHAIN_ANCHOR_ENABLED is on. No tenant identifiers in public log entries. | |
| Payment processing and billing | EU, US | billing_pii, payment_metadata | — | |
| Transactional email (address verification, password reset, invitations, security notices) | EU | email_addresses, names, email_content | Added 2026-10-13; in production before then and missing from this list. Hosted in France by the provider's own statement. | |
| Hosting of the web portal (pages and the server functions that relay requests to the Norcaster API) | US, EU | account_metadata, session_tokens, customer_payloads_in_transit | Added 2026-10-13; in production before then and missing from this list. Portal requests pass through its server functions on their way to the API. The function region is a Vercel project setting. | |
| Customer-configured | Embeddings and semantic retrieval | US | text_for_embedding | Only when used for RAG or semantic cache. |