One index for everything a buyer has to check.

Procurement asks the same eight questions in a different order every time. This page collects the answers and links straight to the source document rather than paraphrasing it: what is processed, where, by whom, under what terms, and what happens when something goes wrong.

The documents procurement usually wants

• Data processing agreement and the current sub-processor list.
• Security posture, including the gaps, stated plainly.
• AI-use policy: what models see, what is retained, what is never sent.
• Service level commitments and the refund condition on delivery.
• Accessibility conformance statement and known exceptions.

Sub-processors change, and you get told

Model providers, telephony, speech, and hosting vendors are all named on the sub-processor page. A change to that list is a material change to your data flow, so it is published before it takes effect rather than after, and customers under a data processing agreement get notice directly.

What is deliberately absent

No trust badges we did not earn and no compliance logos for frameworks we are not certified against. If a page here says a control exists, it is a control an auditor could observe. The security posture page lists what is missing for the same reason.