Note

Here is the full list of sub-processors at 21RISK. A sub-processor is a third-party data processor engaged by 21RISK, who agrees to receive data from 21RISK in accordance with instructions given by 21RISK.

Name	Activities	Country	Notes	Compliance
Planetscale	Database as a Service	USA	Data is stored in AWS eu-central-1. Read more here	SOC2 Type 2
Vercel	Platform for applications	USA	Vercel is where our frontend and backend is hosted, running serverless and edge functions. Read more here	SOC2 Type 2
Doppler	Secrets service	USA	Secrets management. Read more here	SOC2 Type 2
Pusher	Realtime cloud services	Holland	We use pusher to enable real-time collaboration in our application.	SO/IEC 27001:2013
Cloudflare	Cloud services	USA	We use Cloudflare to manage DNS configuration & backups, and to store and serve all files: the files users upload, and 21RISK's public files (website, documentation and product update images), from Cloudflare R2 in the EU. Read more here	SOC2 Type 2, ISO27001
Google Cloud	Backup storage	USA	Keeps the off-site backup of the files users upload, in a Cloud Storage bucket in the EU. Read more here	SOC2 Type 2, ISO27001
Mux	Video hosting and streaming	USA	Hosts and streams 21RISK's own videos: on the website, in the documentation and product updates, and the video introductions in the web-application. Training videos customers upload are stored on Cloudflare R2, not with Mux. Read more here	ISO27001, GDPR, EU-US DPF
Voyage AI (by MongoDB)	AI embeddings	USA	Turns the text of the documents customers upload, and the descriptions of their images, into embeddings, which describe what each page is about, so the AI assistant and agents can search them by meaning. Only for organizations that have turned on AI, through the Vercel AI Gateway; Voyage AI doesn't train on the data. Read more here	SOC2, HIPAA
Anthropic	AI image labels and descriptions, and reading scanned pages	USA	Looks at the images customers upload and labels what is in them (a person, an identifiable face, suggestive or explicit content), so 21RISK administrators can find images that need a look, and describes what each shows and the text in it, so the AI assistant and agents can find them by searching. Also reads the pages of uploaded PDFs that have no usable text of their own, such as scans, from an image of each page, so they can be searched too. Only for organizations that have turned on AI, through the Vercel AI Gateway with zero data retention: Anthropic keeps no copy of the images or pages and doesn't train on them. Read more here	SOC2 Type 2, ISO27001, ISO42001
Sentry	Cloud services	USA	Sentry is used for error handling and monitoring.	SOC2, ISO27001
PDF Shift	Generate PDF's	France	When users export pages as PDF's in 21RISK, it's powered by PDF Shift
Lettermint	Email service	Netherlands	Lettermint is used to send transactional emails.	GDPR

Last updated October 21st, 2026