Subprocessors and service providers
Review draft · October 20, 2026 · Not yet adopted. This page identifies providers that process information to deliver Rialto and the limits of the reviewed information. It does not replace a signed data-processing agreement or promise particular provider protections. Rialto is operated by Tomasz Jezak, an individual. Contact tomasz@userialto.com.
Core product
Cloudflare, Inc. — hosting, object storage and operations
Purpose: deliver the marketing site and product frontend; route API traffic; run backend containers; store originals and prepared artifacts in private R2; record operational logs. Data: requests and technical identifiers, account and project information handled by the backend, uploaded files, processing artifacts and diagnostic records. Location: reviewed API/job containers and R2 buckets are Western North America; network, control-plane and support processing can be global. R2 placement is not a contractual US-only residency restriction. Cloudflare Pages hosts this legal preview. Provider privacy notice.
Neon — managed PostgreSQL
Purpose: store accounts, project metadata, chat, pricing libraries, measurements, estimates, jobs and audit history. Data: structured customer records, content included in chat/tool records, and derived outputs; database recovery history and branches may contain earlier copies. Location: deployment documentation identifies AWS us-west-2 (Oregon, USA); current recovery-window and branch inventory require operator confirmation. Provider privacy notice.
AI model providers — document processing
Purpose: process uploaded document content to deliver takeoffs, answers and reviews, including project chat, original-document reading, pricing-library matching and corrections. Data: relevant instructions/chat, filenames, document text and rendered drawing/page images, pricing-library descriptions and values, evidence, tool results and generated output. Location: processing may occur in the US and other countries under the applicable providers’ arrangements; no region pin or zero-retention arrangement has been verified for this deployment.
Provider processing, retention, model-improvement and safety-review practices are governed by the applicable provider terms, policies and settings. This draft does not promise that AI model providers never use submitted content for model improvement. This entry identifies a provider category rather than individual companies. Contact us for current provider identities, feature-specific use and applicable terms, and to agree an acceptable processing arrangement before submitting confidential information.
Correspondence, not automatic project-file delivery
Microsoft 365, Proofpoint and GoDaddy-related mail infrastructure
Purpose: Rialto-domain email hosting, routing, security filtering and administration. Domain configuration identifies Microsoft 365 and Proofpoint mail gateways, with GoDaddy-related mail/SPF records. Data: sender/recipient details, headers, message bodies and attachments you choose to email to Rialto, plus mail-security metadata. Location: exact mailbox tenant, retention, gateways and processing locations have not been confirmed; no US-only promise is made. These are correspondence providers, not evidence that all app uploads are forwarded to email. Microsoft privacy · Proofpoint privacy · GoDaddy privacy.
Other paths and limits of this list
AI model providers used for a feature may vary with its configured processing path. Contact us for the current named providers and which features use them. Vendor RFQ/Gmail sending is removed from the reviewed build, although legacy database records can remain. No Vercel Analytics, third-party advertising SDK or external error-tracking SDK was identified in the reviewed marketing source; Cloudflare operational logging is enabled. Dashboard-injected scripts and provider account access still need an administrative audit.
Each provider may engage its own subprocessors. This page lists identified direct services and the AI model providers category, not every individual provider or downstream infrastructure company. A signed DPA should define authorization, flow-down obligations, locations, change notices and objections before regulated processing.
Needs lawyer review before adoption
- Confirm exact contracting entities and agreements for Neon and the mailbox/reseller chain.
- Confirm AI processing disclosures, applicable provider terms, retention and locations.
- Approve subprocessor change-notice/objection terms and cross-border transfer safeguards where required.
- Verify provider account settings, branch/log retention, access roster and any dashboard-injected analytics.