Trust · Sub-processors
Sub-processor List
Last updated: May 19, 2026
Richpanel acts as a data processor for our customers. To deliver the Richpanel Services we engage a small set of carefully vetted sub-processors that may handle Customer Data on our behalf. Each sub-processor is bound by a written agreement that holds them to data-protection standards equivalent to ours. This page reflects Richpanel's default offering, where hosting occurs in the United States.
1. Current sub-processors
The following entities are engaged by Richpanel to process Customer Data as sub-processors:
| Entity | Purpose | Region |
|---|---|---|
| Amazon Web Services, Inc. | Cloud hosting, storage, and processing of Customer Data | United States |
| MongoDB Atlas | Database storage (operational data, conversations, configuration) | United States |
| Pinecone Systems, Inc. | Vector database used by Richpanel's AI agents for retrieval-augmented responses | United States |
| OpenAI, L.L.C. | Large language model inference via API for AI agent responses | United States |
| Anthropic PBC | Large language model inference via API for AI agent responses | United States |
| Twilio, Inc. | SMS and voice channel connectivity | United States |
| 360dialog GmbH | WhatsApp Business API connectivity | Germany |
Note: 360dialog is the only sub-processor that hosts Customer Data outside the United States. If your contract requires EU-only or region-restricted processing, contact privacy@richpanel.com before signing.
2. How we vet sub-processors
Before engaging a sub-processor, Richpanel reviews:
- The sub-processor's security certifications (SOC 2, ISO 27001, or equivalent) and most recent audit reports.
- Whether the sub-processor's data-processing terms meet GDPR Article 28 requirements.
- Where the sub-processor stores and processes data, and whether appropriate transfer mechanisms (EU SCCs, UK IDTA) are in place.
- Whether the sub-processor's incident-response commitments align with Richpanel's own breach-notification obligations to customers.
3. Changes and notifications
Richpanel may engage additional sub-processors or replace existing ones from time to time. When that happens, we will update this page and, where required by the underlying agreement or applicable Data Privacy Laws, give notice to customers in advance so they have time to evaluate the change.
4. Customer right to object
Customers who have signed Richpanel's Data Processing Addendum may object to the engagement of a new sub-processor on reasonable data-protection grounds. To do so, contact our DPO at dpo@richpanel.com within fifteen (15) business days of the change notice. If we cannot resolve the objection, the customer may terminate the affected services for cause as set out in the DPA.
5. Contact us
For questions about Richpanel's sub-processors or any aspect of our data-processing program, write to:
Data Protection Officer
Manoj Kumar Pathipati
dpo@richpanel.com
Privacy Team
privacy@richpanel.com