Subprocessors
Last Updated: April 24, 2026
17789491 Canada Inc., operating as Triangle Trade Intelligence, uses the following third-party subprocessors to deliver our tariff intelligence platform. This page is provided for transparency and to support our customers' data protection compliance obligations.
Data Residency
All personal data (account information, authentication tokens, usage logs) is stored and processed in Canada. Canada holds an adequacy decision under the EU General Data Protection Regulation (GDPR), meaning personal data transfers from the EU/EEA to Canada do not require additional transfer mechanisms such as Standard Contractual Clauses (SCCs) or International Data Transfer Agreements (IDTAs).
Infrastructure Subprocessors
These subprocessors store or route personal data:
| Subprocessor | Purpose | Data Processed | Location |
|---|---|---|---|
| Supabase (PostgreSQL) | Database, authentication | Account data, API keys, usage logs, session tokens | Canada (ca-central-1) |
| Vercel | Application hosting, serverless functions | HTTP request routing, static assets, function execution | Canada (Montreal, yul1) |
| Stripe | Payment processing | Billing contact, payment method, invoice history. No trade data. | United States |
AI Inference Subprocessors
These subprocessors provide AI classification and analysis capabilities. They receive only non-personal commercial data (product descriptions, HS codes, country codes, trade values). No subscriber identifiers, account information, or personal data is included in AI requests.
| Subprocessor | Purpose | Data & Retention | Location |
|---|---|---|---|
| OpenRouter | AI inference routing layer — all model requests pass through OpenRouter before reaching Anthropic or Google | Product descriptions, HS codes (no PII). Account-wide training opt-out enabled via X-Training: false header on every request. Compliance documentation on file as of April 24, 2026 via OpenRouter Trust Portal (trust.openrouter.ai): SOC 2 Type II Report (period July 15 – October 31, 2025), SOC 2 Type I Report (as of July 15, 2025), Bridge Letter (January 13, 2026), Penetration Test Report (Q3 2025, redacted), Letter of Engagement, and Data Processing Agreement. Available to customers and prospects under NDA via privacy@triangle-trade-intel.site. SCCs available for EU data transfers (confirmed by OpenRouter). | United States |
| Anthropic (Claude, via OpenRouter) | AI classification — primary model for HS code classification, tariff analysis, and compliance reasoning | Product descriptions, HS codes (no PII). Retention: 30 days. No model training on customer data. | United States |
| Google Vertex AI (Gemini, via OpenRouter) | AI classification — fallback model when Anthropic is unavailable | Product descriptions, HS codes (no PII). Routed to Vertex AI endpoint. Zero-data-residency (ZDR) status: pending written confirmation — OpenRouter enterprise form submitted. | United States (Vertex AI) |
X-Training: false header across all 19 production inference files. Anthropic retains request data for up to 30 days for safety monitoring; no model training occurs on customer data. OpenRouter has confirmed Standard Contractual Clauses (SCCs) are available for EU data transfers. OpenRouter's SOC 2 Type II Report, SOC 2 Type I Report, January 2026 Bridge Letter, Q3 2025 Penetration Test Report, Letter of Engagement, and executed Data Processing Agreement are on file as of April 24, 2026 and available to customers and prospects under NDA. Google Vertex AI zero-data-residency confirmation is pending OpenRouter enterprise response.Changes to This List
We will update this page when subprocessors are added or changed. Material changes that affect the processing of personal data will be communicated via email at least 14 days before they take effect. You may subscribe to updates by contacting us at the address below.
Contact
For questions about our subprocessors or data processing:
Email: privacy@triangle-trade-intel.site
Subject: Subprocessor Inquiry