The published list is the website page, apps/website/app/sub-processors/page.tsx, served at
https://vlozi.app/sub-processors. It is the only list: the Privacy and Security pages link to it and carry none of their own.
This file used to hold a long-form draft. It duplicated the page and drifted from it, so it was replaced by this pointer. The draft is in git history
(commit b70fc616; the version with the operator filled in is 9673b57d).
Open points, tracked in ../communication/ses-production-access/gap-log.md:
- No agreement is on record for any AI provider (Anthropic, Google Gemini, OpenAI), so the page does not say they are barred from training on the content they receive. Say it only after reading each provider's terms and the tier in use (G59).
- The Standard Contractual Clauses claim on the Privacy page is unverified for each provider (G59).
- The Neon and Cloudflare R2 regions cannot be verified from the repository (G73).
- A change to this list must be emailed to customers at least 14 days before it takes effect; the page promises that.