Appearance
Sub-Processors v3.9
Last updated: September 30, 2026
This is the canonical list of third-party providers that store or process data on AI4Love's behalf. The System Architecture page points here. Source systems your organization connects (Blackbaud, Mailchimp, Environics) are your vendors, not AI4Love sub-processors. AI4Love reads from them and never writes back.
Providers
| Provider | Role | Data it touches | Region | Certification | Notes |
|---|---|---|---|---|---|
| Anthropic | LLM text generation (Claude API) for nightly insight text and dashboard campaign generation | A constrained payload: supporter name, detected pattern type, supporting metrics, and the activity timeline (donations, volunteering, engagements, and events). Not email, phone, street address, date of birth, payment method, or government ID. | US (AI4Love API tier). | SOC 2 Type II, ISO 27001:2022, ISO/IEC 42001:2023 | API-tier processing by AI4Love (nightly agents and campaign generation). A staff member's own Claude app connected through MCP is client-side assistant use under that workspace's terms, not this row. Not used for training. Retention up to 30 days for trust and safety, then deleted. Zero-retention available by contract. AI4Love confirms the retention posture in your DPA. See AI Behavior. |
| OpenAI | (a) Text embeddings (text-embedding-3-large) for the KindMind research index. (b) LLM provider on the MCP path when staff connect through ChatGPT. | (a) Research documents for the KindMind index and the query text used to search it. Where the research-enrichment agent is activated, that query text derives from insight text. No supporter records. (b) The scoped, purpose-specific tool responses described on the MCP Access Model page, for the queries staff run. | US (AI4Love API tier for embeddings). On the MCP path, requests originate from the staff member's own ChatGPT workspace and residency follows that workspace's settings, which AI4Love does not control. | SOC 2 Type II, ISO/IEC 27001:2022 | (a) is API-tier processing by AI4Love. (b) is client-side assistant use under the staff member's ChatGPT workspace terms, which AI4Love does not control. Not used for training. Retention up to 30 days for abuse monitoring, then deleted. Zero-retention available depending on contract tier. See MCP Access Model. |
| Airtable | Working base: one dedicated base per organization, held in AI4Love's own account | Normalized supporter, activity, insight, and workflow records the nightly analysis agents require | US (AWS us-east-1); AI4Love uses the Team plan. | SOC 2 Type II, ISO/IEC 27001:2022 | Bounded Retention: the base exists only while service is active, plus a 90-day exit window, then it is deleted. Full export or immediate deletion on request. Deleted records are recoverable from the trash for 7 days and bases for 30 days, then permanently removed. Base snapshots are restore-only, retained up to 1 year on our Team plan (Airtable snapshot policy), never queried by AI4Love, with logged deletions re-applied before a restored base returns to service. See Data Handling. |
| Pinecone | Vector search: the KindMind research index and a per-client knowledge vault | Research embeddings (KindMind) and organization knowledge (Vault). No supporter, activity, or insight records. Beyond the working base, AI4Love does not retain supporter data. Processing in between is transient only. | US (AWS us-east-1, Virginia; Starter plan) | SOC 2 Type II | No supporter data. Client vault purged at end of service. The MCP server only reads; writes come only from AI4Love's internal ingestion of curated research and organization documents. See System Architecture. |
| Vercel | Application hosting and compute: backend API, dashboard, and MCP server | Request data in transit only. The system is stateless. Runtime logs hold request metadata with no supporter PII. Environment variables and build artifacts are encrypted at rest. | US (Washington, D.C., iad1), pinned in the backend API and MCP server vercel.json files | SOC 2 Type II, ISO 27001:2013 | Runtime logs are retained one day on the Pro plan. The Axiom Log Drain streams backend API and MCP runtime logs to Axiom for 30-day retention. See Security Controls. |
| Nango | OAuth credential management for connected platforms | Source-system OAuth credentials only, encrypted at rest. No supporter data. Connection and disconnection events in its audit log. Source-system records are fetched by AI4Love's own servers, not routed through Nango. | US. AWS Aurora PostgreSQL hosted in AWS. | SOC 2 Type II | AI4Love does not offer a Canadian or self-hosted Nango deployment. Tokens are destroyed on disconnect. See Data Handling. |
| Axiom | Log drain for application audit events and Vercel runtime logs from the backend API and MCP server | Audit event fields (route or tool, authentication method, organization, status, timestamp, duration; MCP lines also carry staff account ID, client ID and host label, granted scope and token audience) plus request metadata (caller IP, user agent). Includes staff email addresses as the actor identifier. No supporter data. Fields come from the application lines and Vercel request metadata; see Audit Logging. | US (AWS us-east-1) | SOC 2 Type II | 30-day retention on Axiom's Personal plan (retention policy). Log Drain added September 14, 2026; covers ai4love-backend and stilltide-mcp only. |
| Doppler | Secrets management | API keys and the Airtable Service Account Access Token. No supporter data. | US (GCP us-central1) | SOC 2 Type II, ISO 27001 | Keys are never committed to code or logs. Credential access and rotation audit trail retained 90 days. See Data Handling. |
| Clerk | Identity verification for dashboard sign-in (passwordless one-time code to the staff member's work email) | Staff account data only: names, email addresses, and authentication records. No supporter data. No client passwords or directory credentials are held. | US. No regional data residency offered. | SOC 2 Type II | After verification, the backend issues an AI4Love JWT with a 24-hour expiry. Access is invite-only. See Security Controls. |
| Resend | Transactional email to staff (invites and notifications) | Staff email addresses and message content. No supporter data. | US. Stored account data, email metadata, and logs reside in the United States. Sending region: us-east-1 (North Virginia). Resend carries staff notification email only, never supporter data. | SOC 2 Type II | Not used for supporter communication. AI4Love does not send messages to supporters. |
| Make.com | Agent orchestration (nightly runs) | Queued supporter records and the day's insight records, read from the working base to schedule and route each nightly agent run. Timeline prefetch and Claude API calls run in the AI4Love backend, not in Make.com. | US (Make data center zone us2) | SOC 2 Type II, ISO 27001 | Runs six agents nightly plus one per-organization agent. See System Architecture. |
How this list changes
Each sub-processor operates under their own independently audited security standards. AI4Love monitors provider status pages and security advisories. Changes to sub-processor agreements or compliance status are communicated to affected organizations. A new provider is added to this page and to the Changelog before it receives any organization data.