Who processes whatAnd where it runs.
These are the services RedactWall itself buys and runs the pilot on. Each is listed with what it does for us and where it runs.
Last reviewed 2026-09-25. Reviewed annually, and restated on every change to this list.
The pilot service has not yet processed customer content, so this list is the standing disclosure of who would process what rather than a record of processing that has already happened. Processing commitments must be reviewed and agreed in writing before any enrollment; the pilot agreement is a draft for counsel review, and there is no executed pilot agreement today.
The two product records that describe this environment now agree. The vendor due-diligence file, verified against the running account on 2026-09-25, records that RedactWall operates the production cell itself in AWS us-east-2, that it has served since August 2026, and that no customer device is enrolled, so no employee AI activity or member content from a customer has been inspected or stored. It lists AWS, Auth0, Microsoft 365 and Porkbun as subprocessors, with SES among the AWS services. The infrastructure record separately notes the deployment observed on 2026-08-25, in which the console served over TLS and sign-in by work email was live. The owner provides the current position on request.
Amazon Web Services: S3 and CloudFront
- Purpose
- Stores and delivers this marketing site. It holds published pages and no customer data.
- Location
- Origin bucket in AWS US East (Ohio), us-east-2. CloudFront serves from its global edge locations, and its certificate is issued in AWS US East (N. Virginia), us-east-1, because CloudFront accepts one only from that Region.
- Status today
- In service. This is the only entry on the list serving today that a reader can check from where they are sitting: it is delivering this page.
Amazon Web Services: EC2 and EBS
- Purpose
- Is where the console, the API, the AI gateway and the mail relay are deployed, together with the PostgreSQL databases that would hold the audit record and the employee activity store. Volumes are encrypted with a customer-managed KMS key chosen when the volume is created.
- Location
- AWS US East (Ohio), us-east-2.
- Status today
- In service since August 2026: the production cell runs on one instance with both databases, and holds requester and operator identities and pilot requests. Its location was verified against the running account on 2026-09-25. Not claimed as processing customer content: no customer device is enrolled, so no employee AI activity or member content has been inspected or stored.
Amazon Web Services: SES and CloudWatch
- Purpose
- Delivers transactional sign-in and notification email, and records aggregate delivery metrics. Open, click and subscription events are deliberately not published, so those metrics carry no recipient-level payload.
- Location
- AWS US East (Ohio), us-east-2.
- Status today
- In service for pilot and workspace notification email and for relaying Auth0 sign-in email; the notice record we keep carries no address or body. No production mail server has submitted to the outbound mail relay in any recorded observation. SES handles each recipient address and message in transit.
Auth0
- Purpose
- Runs the only sign-in interface. It receives the account email address and keeps its own authentication logs. RedactWall requests an identity token only, calls no Auth0 API and holds no client secret.
- Location
- Auth0 tenant redactwall, United States region.
- Status today
- In service for operator sign-ins and the pilot-request identity flow, on a tenant the infrastructure record tags DEVELOPMENT rather than production. Sign-in by work email was observed live on 2026-08-25. A requester can create their own identity before approval; no customer device has been enrolled. That does not establish whether a prospective requester email has reached Auth0.
Porkbun
- Purpose
- Registers the domain and answers authoritative DNS. It receives no customer content.
- Location
- Not recorded. Every infrastructure record naming the registrar names it as the registrar and authoritative DNS and nothing else, so no jurisdiction has been checked, and naming one would be worse than saying so.
- Status today
- In service.
Microsoft 365
- Purpose
- Email to support@redactwall.com sends your address, message and any attachments to Microsoft 365 for support and pilot inquiries. Only the owner, Eric, has access to that mailbox: its access list was verified on 2026-09-25, with no delegates, send-as grants or forwarding.
- Location
- Not read back from the tenant. Exchange server naming indicates North America; that is an inference, not a verified location.
- Status today
- In service for support and pilot inquiries through the published mailbox, whose access list was verified on 2026-09-25. Prospective requesters may also provide a work email to Auth0 for sign-in; Microsoft 365 is not the only service that may receive information from outside the company.
Your vendors across the product catalog
Model providers you select are reached under your own contract with that provider, and are not RedactWall subprocessors. This table covers the broader product catalog. Only the ChatGPT text path and separately verified Anthropic gateway path described in the pilot privacy notice are in the proposed first pilot.
Your model provider: Anthropic, an OpenAI-compatible provider, Google Gemini or Amazon Bedrock
- Reached by
- The AI gateway, for compatible applications you explicitly configure to route through RedactWall
- What it receives
- The request your application was already sending, after our decision, and the response coming back
- Whose contract
- Yours, with that provider
Microsoft Graph and Google Drive
- Reached by
- The cloud drive connector, under your own OAuth credential
- What it receives
- Read requests only. The connector reads from them and writes nothing, against a closed host allowlist, following no redirects
- Whose contract
- Yours, with Microsoft or Google
Your next-hop mail server
- Reached by
- The outbound mail relay
- What it receives
- The message you were already sending
- Whose contract
- Yours
Your evidence destinations: SIEM, ticketing, chat and mail digest
- Reached by
- The evidence worker
- What it receives
- Decision records, not content
- Whose contract
- Yours
Two things this list would be wrong without
The browser extension is in neither list
The browser extension is in neither list on purpose. Traffic from a governed page to the AI provider originates in the page, in the page’s own JavaScript realm, under the page’s own session. RedactWall does not proxy it, and the extension posts a content-free signed event instead.
No model vendor processes anything for us
No RedactWall-operated component sends your content to a model provider for our own processing. If that ever changes, that provider becomes a subprocessor of ours and appears here before it is used.
Contact records have separate handling gaps
Contact records follow a retention schedule adopted on 2026-09-25, not yet reviewed by counsel. Support and pilot-inquiry email is deleted 24 months after receipt, enforced by an Exchange Online retention policy applied on 2026-09-25; the oldest message was received on 2026-08-24, so none reaches that age before 2028-08. A deleted message is then purged after Exchange's recoverable-items window. Auth0 keeps its own authentication logs for 1 to 30 days by plan; the plan on this tenant was not read back. Our streamed copy of those logs is deleted after 365 days by an enforced retention setting. Auth0 identities with no workspace and no sign-in for 24 months are removed at a quarterly review. Pilot request, requester, contact and approval records in the platform database have no deletion today: the database refuses to delete them because they anchor the identity audit chain, so they are kept for the life of the service. A backup set expires about 9 weeks after it is superseded, but new backups keep capturing the retained database records. Requests about your own data are answered within 30 days. The employee activity and training retention periods do not cover these records. Ask about the status of the pilot terms before sharing more information.
Read how email and identity-based requests are handledNotice before a change
The current draft proposes 30 days of notice before a new subprocessor begins processing. That clause has not been reviewed by counsel; any notice obligation must be agreed before enrollment.
What each service processes on your behalf is described in the privacy notice, and the documents a procurement team asks for are recorded under documents for procurement.
Bring this list to your vendor review.
Work with RedactWall to confirm fit, agree the scope and verify one managed device before expanding.
- Every service we run the pilot on is named with its purpose
- Model providers you select stay under your own contract
- The current draft proposes notice; binding terms must be agreed before enrollment