XRAY Bridge maintains a minimal, tightly audited sub-processor footprint. All sub-processors operate within the United States. We do not transfer or replicate customer data overseas, and we execute formal Data Processing Addenda (DPAs) with every vendor.
| Sub-processor | Legal Entity | Data Location & Region | Purpose / Service | Security Certifications |
|---|---|---|---|---|
| Railway | Railway Corp. | United States us-east4 (Northern Virginia) | Cloud application hosting, edge container runtime, and TLS termination Data: Encrypted application traffic, runtime logs, and ephemeral memory execution | SOC 2 Type II, ISO 27001 |
| Neon | Neon, Inc. | United States aws-us-east-1 (Northern Virginia) | Dedicated PostgreSQL 17 serverless database with Row-Level Security (RLS) Data: Multi-tenant structured operational metadata, tasks, decisions, briefs, and envelope-encrypted credentials | SOC 2 Type II, ISO 27001, AWS FedRAMP environment |
| OpenAI | OpenAI, L.L.C. | United States United States | Stage-2 AI verification judge (gpt-4o-mini JSON mode) Data: Task evidence claims and commitment excerpts (API payloads; strictly zero model training, 30-day API cache) | SOC 2 Type II, CCPA, GDPR compliant DPA |
| Resend | Resend, Inc. | United States United States | Transactional email delivery for briefs, invites, and password resets Data: Recipient email addresses, executive brief summaries, workspace invite links | SOC 2 Type II, HIPAA eligible, GDPR DPA |
| Stripe | Stripe, Inc. | United States United States | Billing, subscription lifecycle, and invoice processing Data: Customer payment card credentials, billing address, tax ID (card numbers never touch XRAY Bridge servers) | PCI-DSS Level 1 Service Provider |
| Google LLC | United States United States | Optional Google Workspace OIDC user sign-in and identity verification Data: User profile metadata (email, display name, user ID) during authentication | SOC 2 Type II, SOC 3, ISO 27001, FedRAMP High |
All primary database storage (Neon PostgreSQL 17) and application runtimes (Railway) are located in the Northern Virginia, US cloud regions (aws-us-east-1 and us-east4). Customer data is never routed through or stored in offshore data centers.
Before onboarding any new sub-processor that handles customer data, XRAY Bridge provides at least 30 days advance written notice via email to workspace owners and updates to our public Changelog and Trust Center. Customers retain the right to object or export their data.