# DiligenceVDR.ai

DiligenceVDR.ai (diligencevdr.ai): subprocessors, data processing agreement, security documents and changes, as monitored by Third Party Index.

- Page: https://thirdpartyindex.com/vendors/diligencevdr-ai
- Documents last verified: 2026-09-29
- Transparency rating: 92/100 (how much it publishes, not how secure it is)
- Cite as: DiligenceVDR.ai, Third Party Index, https://thirdpartyindex.com/vendors/diligencevdr-ai (data CC BY 4.0)

## Documents

| Document | URL | Last verified | Last changed |
|---|---|---|---|
| Subprocessor list | https://diligencevdr.ai/trust/ | 2026-09-29 | 2026-09-29 |
| Data processing addendum | https://diligencevdr.ai/dpa/ | 2026-09-29 | 2026-09-29 |
| Privacy policy | https://diligencevdr.ai/privacy/ | 2026-09-29 | 2026-09-29 |
| Terms | https://diligencevdr.ai/terms/ | 2026-09-29 | 2026-09-29 |
| Security page | https://diligencevdr.ai/features/ | 2026-09-29 | 2026-09-29 |
| security.txt | https://diligencevdr.ai/.well-known/security.txt | 2026-09-29 | 2026-09-29 |
| Status page | https://status.diligencevdr.ai/ | 2026-09-29 | 2026-09-29 |
| Security advisories | https://diligencevdr.ai/security/ | 2026-09-29 | 2026-09-29 |

## Subprocessors (12)

As its own list states them.

| Subprocessor | Purpose | Location | Listed since |
|---|---|---|---|
| [Better Stack](https://thirdpartyindex.com/vendors/better-stack.md) | Centralized application log management — aggregates server logs from the API, workers, sidecar, and web for operational diagnostics and alerting; Log management | EU region (DPF + SCCs) | 2026-09-29 |
| [Cloudflare R2](https://thirdpartyindex.com/vendors/cloudflare.md) | Object storage; Stores encrypted customer document files uploaded to data rooms | EU or US (per project; DPF) | 2026-09-29 |
| [ConvertAPI](https://thirdpartyindex.com/vendors/convertapi.md) | Converts CAD drawings (.dwg/.dxf) and Apple Numbers spreadsheets to viewable PDFs when such files are uploaded. Routed to the regional endpoint matching the project's residency (EU projects → EU endpoint, US projects → US endpoint), so document bytes stay in-region; Document conversion / rendering (optional per project) | EU or US (per project; regional endpoints) | 2026-09-29 |
| [DeepL](https://thirdpartyindex.com/vendors/deepl.md) | Document translation (optional per project); Translates uploaded Word/Excel/PowerPoint files when a project user requests translation — the primary engine for files above roughly 50,000 characters of text, and the quality fallback for smaller ones if Azure cannot complete them. DeepL never receives PDFs: its PDF pipeline would introduce a further document-conversion sub-processor, so PDFs stay with Google | EU (DeepL SE, Cologne, Germany — EU data centers) | 2026-09-29 |
| [Google Cloud (Vertex AI & Cloud Translation)](https://thirdpartyindex.com/vendors/google-cloud.md) | AI / LLM provider (optional per project); Vertex AI: document text extraction, vector embeddings, semantic search, chat-based Q&A, and the terminal text fallback for any translation the document engines cannot complete. Cloud Translation: translation of PDF documents when a project user requests it, and failover for Word/Excel/PowerPoint files when the primary engine cannot complete them. Both only when AI features are enabled by the project administrator | EU or US (per project; DPF) | 2026-09-29 |
| Google Cloud SQL (PostgreSQL) | Hosts the PostgreSQL databases that store project metadata, permissions, and audit logs. Three instances: control plane (US-East, shared) for user accounts and project index; US data plane (US-East) for US projects' room data; EU data plane (EU-West, Netherlands) for EU projects' room data. EU projects' document metadata and audit logs never leave europe-west4.; Managed database | US-East and EU-West (DPF) | 2026-09-29 |
| Microsoft Azure AI Translator | Document translation (optional per project); Translates uploaded documents when a project user requests translation: data and text formats (CSV, TSV, TXT, HTML, Markdown, Outlook MSG, OpenDocument spreadsheets), images (JPEG, PNG, BMP, WebP — translated via OCR), and Word/Excel/PowerPoint files under roughly 50,000 characters of text, which is the majority of Office documents in a typical room. Larger Office files go to DeepL first. Azure never receives PDFs | EU or US (per project; West Europe / East US resources; DPF) | 2026-09-29 |
| [Railway](https://thirdpartyindex.com/vendors/railway.md) | Cloud hosting & compute; Hosts the Redis cache and Sidekiq job queue per region (US and EU). No customer document content is stored in Redis; only ephemeral job metadata and session keys.; Managed cache & queue; Runs the web frontend, API, background workers, and document-processing jobs that serve customer traffic. Two regional stacks: US (us-east4, Virginia) and EU (europe-west4, Netherlands). | US-East and EU-West (DPF) | 2026-09-29 |
| [Resend](https://thirdpartyindex.com/vendors/resend.md) | Delivers invitation, notification, and security emails to account holders; Transactional email | EU region (DPF) | 2026-09-29 |
| [Sentry](https://thirdpartyindex.com/vendors/sentry.md) | Collects application error telemetry to diagnose service failures; Error monitoring | EU region (DPF) | 2026-09-29 |
| [Stripe](https://thirdpartyindex.com/vendors/stripe.md) | Payments; Processes billing and subscription payments for paid plans | US (DPF) | 2026-09-29 |
| [WorkOS](https://thirdpartyindex.com/vendors/workos.md) | Authentication & identity; Sign-in, enterprise SSO/SAML, directory sync, and multi-factor authentication | US (SCCs) | 2026-09-29 |

Read from ([evidence](https://thirdpartyindex.com/evidence/17467)). CSV: https://thirdpartyindex.com/vendors/diligencevdr-ai/subprocessors.csv

## Listed as a subprocessor by (0)

No tracked vendor lists it.

## Security contact

From its security.txt (https://diligencevdr.ai/.well-known/security.txt):

- Contact: mailto:security@diligencevdr.ai
- Disclosure policy: https://diligencevdr.ai/security/

---

Third Party Index (https://thirdpartyindex.com) monitors vendors' public security and privacy documents and keeps each version as evidence. Data CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); vendors' own documents are theirs. API: https://thirdpartyindex.com/api