Subprocessors
The third-party services exactbench uses to deliver the product. Each one processes only what's required for the function listed below, under their own data processing agreement.
Last updated: 26 May 2026
| Vendor | Role | Data processed | Location | DPA / Privacy |
|---|---|---|---|---|
| OpenAI | Large-language-model inference for answer generation; embedding model for retrieval | Manual text chunks at query time; user question text; no training on API data | United States · EU-US DPF certified | DPA · Privacy |
| Pinecone | Vector database — stores embeddings of manual content for semantic retrieval | Embedded text chunks (numerical vectors) and chunk metadata (manual ID, page, section) | United States · EU-US DPF certified · EU region available on request | DPA · Privacy |
| Render | Application hosting and managed PostgreSQL database | Application logs; PostgreSQL contents (user accounts, manual metadata, feedback, captured emails) | United States · EU region available | DPA · Privacy |
| Resend | Transactional and pilot-onboarding email delivery | Email address; email subject and body content for messages we send | United States · EU-US DPF certified | DPA · Privacy |
International data transfers
Because our subprocessors are US-based, personal data may be transferred from the EU/EEA to the United States. These transfers are covered by the EU-US Data Privacy Framework where the vendor is certified, and otherwise by Standard Contractual Clauses (SCCs) referenced in each vendor's DPA above.
An EU-only deployment (Pinecone EU region, Render Frankfurt) is available on request for enterprise pilots that require data residency in the EU.
Notification of changes
If we add or change a subprocessor, we update this page and email any active pilot customer at least 14 days before the new subprocessor processes their data. Customers with an active DPA can object to a new subprocessor before that date.
Questions
Write to niall@exactbench.com with the subject line subprocessor question.