Version 1.3. Effective date: October 20, 2026. Prepared with AI assistance and not reviewed by a licensed lawyer. Not legal advice.
Acquiror AI provides informational output only, not investment, legal, tax, accounting, lending, or valuation advice; see the Terms of Service, AI Features and Output.
Subprocessors
On this page
This page lists the subprocessors Acquiror AI (a product of Umplify Technologies Inc.) uses to process personal information and Customer Data on behalf of our customers. It is the authoritative list referenced by our Data Processing Addendum (DPA). If a term used here is not defined here, it has the meaning given in the DPA or, if the DPA does not define it, in the Terms of Service.
A subprocessor is a third party we engage to process personal information or Customer Data in order to provide the Acquiror AI service. This list does not include providers a customer chooses for themselves and configures with their own credentials; those are covered in the separate section below.
Last updated: October 15, 2026
Subprocessor list
| Vendor | Purpose | Data categories | Processing location(s) | Vendor DPA / trust center |
|---|---|---|---|---|
| Microsoft Corporation | Cloud hosting of the backend, database and document storage, background job queues, search indexing, secret storage, monitoring and backups, sign-in, delivery of the web application, transactional email, and platform AI processing | Account and user data, sign-in identity data (name, email address, directory identifier, and the country or region claims presented at sign-in), tenant and organization data, billing records, deal records and the deal-side contacts recorded in them (for example brokers, sellers, advisors and lenders), uploaded deal documents, their extracted text and target-company financial data, AI prompts and outputs, AI-generated drafts and analysis records and cached AI responses, generated export files (decision, investment memo and credit memo files), the document search index (passage text and embedding vectors), question-and-answer history and ratings, in-product feedback and the submitter's contact details, AI usage and rate-limit counters, audit logs, logs and telemetry (request data, which can include user identifiers and email addresses), transactional email content, secrets including a tenant's own AI key, and all other structured deal and contact data held for the Service | Hosting, data at rest and all other processing: Canada (backup copies also in Canada). Sign-in: a global Microsoft service, not pinned to one region. Web application delivery: United States. Transactional email: United States (sender domain: acquiror.ai). Platform AI processing: United States today; under Microsoft's global deployment tier an individual request may be processed in other regions where the model is deployed. | https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA · https://www.microsoft.com/trust-center |
| Stripe, Inc. | Subscription billing, payment processing, invoicing, sales tax calculation, the billing portal, and webhook event delivery | Billing and payment data: customer and subscription identifiers, billing address, tax identification number, transaction amounts, invoice links, tax jurisdiction. Umplify does not store payment card data; card data is entered on and held by Stripe | United States (Stripe's own infrastructure) | https://stripe.com/legal/dpa · https://trust.stripe.com |
Platform AI processing happens outside Canada. Content sent to our built-in AI features, including text from uploaded financial documents and images of scanned pages sent for text recognition, is processed by Microsoft in the United States today, and possibly in other regions under Microsoft's global deployment tier. Microsoft's abuse-monitoring process may hold a sample of flagged prompts and outputs for review in the United States geography of our AI resource. This differs from where your data is stored. A Canadian AI region is on our roadmap; until it ships, treat platform AI processing as occurring outside Canada.
The marketing website's form service (contact, waitlist, and email sign-ups) also runs on Microsoft's cloud, in the United States, and stores its submissions in Canada; it holds no Customer Data and is described in the Privacy Policy, Section 4.
Other third-party services
These providers receive limited technical data when you use Acquiror AI but do not process Customer Data on our behalf:
- Google Fonts. The product application loads its icon font from Google Fonts. Google receives the requesting browser's IP address and user agent for that request. No Customer Data and no cookies are involved.
- Google Analytics 4 and Cloudflare Turnstile on the marketing website (acquiror.ai) only. Analytics loads only after you accept it on the consent bar; Turnstile runs a bot check on pages that have a form. See the Cookie Policy.
Tenant-configured AI providers (not subprocessors)
Acquiror AI's platform default is Microsoft's AI service listed above. A customer may instead configure one of the providers below by bringing its own API key ("BYO-key"); such a provider is a "Tenant AI Provider" as the Terms of Service define it. Anthropic and OpenAI are reachable only through BYO-key configuration; there is no platform-managed, Umplify-keyed path to either provider. When a customer configures a BYO-key provider, Umplify acts only as a conduit: the request is routed using the customer's own provider selection and its own credentials. Umplify does not select these providers on the customer's behalf, and they are not subprocessors under our DPA. The customer's own agreement with that provider governs how it handles the data it receives.
| Provider | When it applies | Governing agreement | Provider DPA / trust center |
|---|---|---|---|
| Anthropic PBC | Tenant selects Anthropic Claude as its AI provider (BYO-key only; tenant supplies its own Anthropic API key) | The tenant's own agreement with Anthropic | https://www.anthropic.com/legal/commercial-terms · https://trust.anthropic.com |
| OpenAI, L.L.C. | Tenant selects the public OpenAI API as its AI provider (BYO-key only; tenant supplies its own OpenAI API key), distinct from the platform AI processing by Microsoft listed above | The tenant's own agreement with OpenAI | The provider's published data processing terms · https://trust.openai.com |
| An OpenAI-compatible gateway of the tenant's choosing | Tenant points its OpenAI-type configuration at a public HTTPS gateway address it operates or subscribes to, with its own key | The tenant's own agreement with that gateway operator | As published by that operator |
Embeddings used for our document search index are always processed on the platform AI deployment listed in the subprocessor table above, regardless of a tenant's chat-model provider selection, because the shared search index is built against one platform-controlled embedding model. A tenant cannot bring its own embedding provider.
How this list is updated
This page is the authoritative, current list of our subprocessors. When we add a new subprocessor, or an existing subprocessor begins processing Customer Data in a new country, we will email account administrators at least 30 days before that processing begins, and customers have the objection right described in our Data Processing Addendum. The "Last updated" line above changes whenever the list of vendors or their processing locations changes; wording and version changes that do not alter the list are recorded in the version line only.