Service Provider Inventory
A technical inventory of third parties documented in Praesidia's current production path and platform integrations.
Technical inventory last verified: October 2026. This page reports the service-provider data path supported by the repository's deployment policy, runbooks, and runtime integrations. It is not a contractual subprocessor schedule and, beyond the OpenAI processing region for platform-configured calls, does not assert provider regions, transfer mechanisms, change-notice periods, or negotiated legal roles. Request reviewed contractual information from legal@praesidia.ai.
| Provider | Documented technical role | Data that may pass through the service |
|---|---|---|
| Render | Current production application hosting for Praesidia's public app, API, and MCP services | Account and platform data handled by those services, including request and response content |
| Amazon Web Services (AWS) | Key management, object storage, and message queuing where those features are configured | Key and encryption metadata, stored objects or audit anchors, and queued service payloads for enabled integrations |
| Cloudflare | Edge proxy and TLS termination at Cloudflare's global edge, in front of the Render production services | Requests and responses sent to public endpoints, plus connection and request metadata |
| Stripe | Payment processing, invoicing, and subscription billing | Billing contact, transaction, and payment-method data |
| Mailgun (Sinch) | Transactional delivery of account, security, and product email | Recipient name and email address, plus transactional message content |
| Sentry (when configured) | Application error monitoring and crash diagnostics | Technical error and request diagnostics, which may include limited account identifiers |
| Sigstore Rekor (when external anchoring is enabled) | Public transparency-log anchoring for audit-integrity proofs | A signed hash of each audit-trail batch and the public key that verifies it; never the audit records or their content. Log entries are public and permanent. |
| OpenAI (platform-configured connection) | Model inference when an organization uses the platform's configured default instead of its own provider connection, and guardrail content evaluation and moderation screening when configured. Platform-configured calls are processed on OpenAI's standard (US) API by default, or on OpenAI's EU data-residency API when the deployment is configured for it. An organization's own OpenAI connection uses that organization's OpenAI account instead | Prompt and response content for those model requests, and the content screened by those guardrail checks |
| Anthropic (when configured) | Guardrail content evaluation (LLM judge) | Prompt and response content sent for evaluation |
| Microsoft Azure AI Content Safety (when configured) | Guardrail content-moderation screening | The content screened |
Current hosting boundary
Render, behind Cloudflare, is the current live production host for Praesidia's public app, API, and MCP services; this inventory does not state where Render runs them. Cloudflare terminates TLS at its global edge before requests reach Render, so this inventory does not describe an EU-only data path.
Customer-configured model connections
An organization can configure its own provider connection. Through the gateway's one base URL or as an agent's configured model, from the same list on both paths: OpenAI, Anthropic, Azure OpenAI, Google Gemini, Mistral AI, Cohere, DeepSeek, Qwen, Moonshot, a self-hosted Ollama, or your own OpenAI-compatible endpoint. Praesidia routes model requests only to the connection selected for that organization. The contractual role of a customer-selected provider depends on the applicable account and agreement and is therefore not assigned by this technical inventory.
Questions
For technical privacy questions, email privacy@praesidia.ai. For questions about the availability of a reviewed DPA or contractual provider schedule, email legal@praesidia.ai.