Sub-processors
Effective 5 October 2026 · Version 1.2 · Scope: the Global AI Risk platform
Who processes your data
Global AI Risk is operated by Crane Consulting Firm, which is the entity named as processor in your customer agreement and its data processing addendum. The parties below are its sub-processors for this platform. Crane Consulting Firm's other services are out of scope for this page and engage different processors.
Current sub-processors
| Processor | Purpose | Data processed | Region & retention |
|---|---|---|---|
| Microsoft Azure App Service · Database for MySQL |
Application hosting and primary data storage | All platform data: account details, organisation records, model selections, assessment history, audit logs | Canada East life of the account; removed within 30 days of a deletion request, and from backups within the 7-day recovery window |
| Perplexity api.perplexity.ai |
Search-augmented AI used for vendor research, risk scoring, and generated analysis | Publicly available vendor and model information. For deployment assessments and model requests, the context you supply — see below | North America (processing only) queries not retained; billing metadata only |
| Resend resend.com |
Transactional and notification email | Recipient name, email address, and message contents | US East (N. Virginia) us-east-1 |
3 processors, and no others.
What is sent to our AI provider
Most of what we send is public information about vendors and models, and none of it originates with our customers. There are two exceptions, and they are the only two:
- Organisation deployment assessments. Your industry, deployment type and scope, autonomy level, data type, user base, and any free-text notes you add.
- Model requests. The model name, the provider, and the use case you describe, so a preliminary assessment can be produced for you.
In both cases your name, email address and account identifiers are not included, and nothing sent on either path is retained by the provider.
Data processing agreements
- Microsoft Azure — Microsoft Products and Services Data Protection Addendum. In force — incorporated into the Azure online services terms
- Perplexity — Perplexity Data Processing Addendum. Perplexity's published API documentation states that query data sent to the API is not retained and is never used for model training (verified 4 October 2026)
- Resend — Resend DPA (signed). Executed — countersigned by Resend, effective on account creation
Not sub-processors
- Public data sources — Vendor websites, certification registers, the National Vulnerability Database, and news sources. We read from these; we send them nothing.
- GitHub — Source control, automated testing, and AI-assisted review of our own source code. Test runs use synthetic fixture data in a disposable database and never connect to production systems. No customer data is sent.
- Outbound operations webhooks — Our own administrators can route internal system alerts to an HTTP endpoint of our choosing. The payload carries alert counts, a rule name and a timestamp; it contains no customer data.
Changes to this list
We will publish an updated version of this page before a new sub-processor begins processing customer data. Customers with an active agreement will be notified at least 30 days in advance, using the contact on file.
- 1.2 — 5 October 2026 — Azure retention now states the 30-day deletion commitment and the backup window. GitHub's entry notes AI-assisted code review of our own source, enabled 5 October 2026 — it receives no customer data, so it remains outside the processor list. No processor added or removed; the notice period does not apply.
- 1.1 — 4 October 2026 — Perplexity entry corrected: states the processing region, distinguishes query data from billing metadata, and cites the published API documentation rather than asserting a plan or an executed DPA. No processor added or removed, so the notice period below does not apply.
- 1.0 — 25 September 2026 — First publication.