Last updated: June 4, 2026
# Orizu Subprocessors
This page lists the third-party service providers Orizu Inc. ("Orizu") engages as subprocessors to provide the Orizu platform. A subprocessor is a third party that processes Customer Personal Data on Orizu's behalf in connection with the platform.
This list is incorporated by reference into Orizu's Data Processing Agreement.
## Current Subprocessors
| Subprocessor | Entity & Location | Purpose | Data Categories Processed |
|---|---|---|---|
| Anthropic | Anthropic, PBC - San Francisco, CA, USA | LLM inference for automated evaluation, prompt iteration, and chat features. Governed by Anthropic's commercial API terms; Anthropic does not use customer content to train its models. | Prompts and model inputs/outputs submitted to the Service for processing |
| OpenAI | OpenAI, L.L.C. - San Francisco, CA, USA | LLM inference for automated evaluation, prompt iteration, and chat features. Governed by OpenAI's API terms; API data is not used to train OpenAI models by default. | Prompts and model inputs/outputs submitted to the Service for processing |
| Google Gemini | Google LLC - Mountain View, CA, USA | LLM inference for automated evaluation, prompt iteration, and chat features. Governed by Google's paid Gemini API terms; Google does not use prompts or responses to improve products on the paid tier. | Prompts and model inputs/outputs submitted to the Service for processing |
| Vercel | Vercel Inc. - San Francisco, CA, USA (US regions / edge infrastructure) | Application hosting and edge delivery for the Orizu web application and API. | HTTP request and response metadata; runtime application logs (short retention) |
| Supabase | Supabase Inc. - San Francisco, CA, USA (data hosted on AWS, us-east-2) | Managed PostgreSQL database for persistent application data; encrypted secret vault (pgsodium) for Customer-provided third-party credentials. | All Customer Content persisted by Orizu, including datasets, eval traces, prompts, LLM inputs and outputs, model configurations, annotations, and judges; encrypted Customer-provided credentials |
| Braintrust | Braintrust Data Inc. - San Francisco, CA, USA | Trace logging for Orizu's chat experience. Used to log chat inputs and outputs, model metadata, token usage, and in some cases a subset of the dataset being worked with. Trace retention: 14 days. | Chat conversation inputs and outputs, model metadata, token usage, and incidental subsets of Customer datasets associated with chat sessions |
All current Orizu subprocessors are based in the United States. Customer Personal Data is processed in the United States.
## Updates and Notification
Orizu may engage new subprocessors or replace existing subprocessors from time to time. When this list is updated, the "Last updated" date at the top of this page changes.
Customers with an active Data Processing Agreement may subscribe to advance notice of subprocessor changes by emailing security@orizu.ai with the subject line "Subprocessor notifications". Subscribed customers will receive at least 30 days' advance written notice of any new or replacement subprocessor that will process Customer Personal Data, and may object on reasonable grounds in accordance with the Data Processing Agreement.
## Customer Responsibility for Source Data
Customers control what data is provided to Orizu, including by selecting source records, configuring filters, and using their own observability or evaluation tools to feed records into the Service. Customers are responsible for excluding or sanitizing categories of personal data they do not wish to transfer to Orizu before providing data to the Service.
## Contact
Questions about this page or about Orizu's subprocessors:
Orizu Inc.security@orizu.ai