Skip to content
AskVault Docs
Try Free →

AskVault sub-processors

Written by , Principal Architect, Networks and Tech, AskVault · Reviewed by Allison Chan
Last updated: · 4 min read

Sub-processor categories

A sub-processor is a third party that processes customer data on AskVault's behalf. We use a small set, organized into six categories:

  • Database and vector storage. Holds workspace content, embeddings, conversations, audit logs.
  • Application compute. Runs the AskVault application servers and background workers.
  • Edge, DDoS, and DNS. Terminates TLS, mitigates DDoS, routes traffic to our region.
  • LLM providers. Used per-query for the generation step in retrieval-augmented answers. Contractually opted out of training on your data.
  • Email and notification delivery. Transactional emails (password reset, account confirmation, alerts).
  • Payment processing. Subscription billing. We never see card details; the payment processor handles PCI scope.

Each category has a single primary provider plus optional fallbacks for resilience.

Why we don't publish specific provider names publicly

Two reasons:

  1. Competitive surface area. Publicly advertising our exact stack helps competitors copy our architecture without investment. We prefer to discuss specifics under NDA.
  2. Security through opacity is not security. All providers we use are SOC 2 Type II certified, AES-256 encrypting at rest, TLS 1.3 in transit. The compliance posture is the same regardless of who's underneath. Knowing the specific provider doesn't change the security profile materially.

Procurement teams that need the full list for vendor management can get it under NDA. Email security@askvault.co with your point of contact and timeline.

Where data flows

For a typical AskVault customer query:

  1. Visitor message arrives at our edge provider, terminates TLS, forwards to application compute.
  2. Application compute authenticates, validates, and forwards to our database for retrieval.
  3. Database returns matching content chunks based on vector similarity.
  4. Application compute assembles a prompt with the retrieved chunks plus the question, sends to an LLM provider.
  5. LLM provider generates the response, returns to application compute.
  6. Application compute assembles the final response with citations, returns through the edge to the visitor.

Total data flow: edge -> compute -> database -> compute -> LLM -> compute -> edge -> visitor. All in TLS 1.3 transit.

LLM provider handling

LLM providers are the most-asked-about sub-processor category. Three things to know:

  • Contractually opted out of training. Every LLM provider AskVault uses is contracted with their training-opt-out terms in effect. Your data is not used to improve their models.
  • Per-query routing. Each query may route to a different LLM provider depending on plan tier, query type, and provider availability. The relationship is per-query, not per-customer.
  • Zero retention beyond inference. LLM providers don't retain prompts or responses beyond the duration of the inference call. Confirmed in our DPA with each provider.

Geographic data flow

Customer data flows through:

  • Primary processing region. Asia-Pacific (Mumbai). Compute and database deployed in the same regulatory zone for performance and compliance.
  • LLM provider region. Typically US-East or EU, depending on the provider and query. Data crosses regions for the inference step but is not stored at the LLM provider.
  • Edge region. Distributed globally via our edge provider's POPs.

Change notification process

Per our DPA, AskVault notifies customers 30 days in advance when:

  • A sub-processor is added.
  • A sub-processor is removed.
  • A sub-processor's scope changes materially (e.g., we expand the LLM provider relationship to include training).

Notification methods:

  • Email to the workspace owner's account email.
  • In-product notification in the dashboard under Settings > Notifications.

Customers can object to a sub-processor change. If we cannot resolve the objection within 30 days, you can terminate the affected workspace with data export per our DPA.

Audit reports per sub-processor

Each sub-processor's audit report (SOC 2, ISO 27001, etc.) is available under NDA via your Account Manager. Most enterprise procurement teams want:

  • Database provider SOC 2 Type II. Confirms storage-layer encryption, access controls, availability.
  • Compute provider SOC 2 Type II. Confirms infrastructure isolation.
  • Edge provider SOC 2 Type II + ISO 27001. Confirms network-layer controls.
  • LLM provider DPA + opt-out evidence. Confirms your data isn't used for training.

Some sub-processors restrict their audit reports to direct customers only. In those cases AskVault provides a Letter of Confirmation summarizing the relevant controls.

How customer data is segregated

Within each sub-processor, AskVault's data is segregated from any other tenant data the sub-processor handles. Database tenancy: separate database instance for Enterprise customers; multi-tenant on a shared instance with hard workspace-level partitioning for standard plans. Compute: per-process isolation; no shared memory across customer requests.

Common questions

Do customer logos show up on the sub-processor's marketing pages?

No. AskVault doesn't share customer information with sub-processors beyond what's required for the service. Customer logos and case studies require explicit customer permission and don't flow through sub-processors.

Are PHI sub-processors covered under our HIPAA BAA?

Yes for Enterprise HIPAA customers, built on HIPAA-eligible infrastructure with a signed BAA. Provider-level BAAs are put in place with the sub-processors that process PHI as part of that agreement.

Can I exclude a specific sub-processor?

For most customers, no. The sub-processor stack is integrated and per-customer exclusion isn't feasible. Enterprise contracts can request specific sub-processor exclusions; we evaluate case by case.

What happens if a sub-processor has a security incident?

AskVault's incident response runbook activates. Affected customers are notified without undue delay, consistent with our GDPR and DPA obligations. Post-incident review is shared on Enterprise plans.

How often does the sub-processor list change?

Rarely. Typically 1 to 2 changes per year. Each change goes through the 30-day notification process.

Was this page helpful?