This register identifies the principal external providers that may process personal data when 4TRAITS LLC operates its website, protected tools and related services. It should be read with the Privacy Policy.
Register version: 1.1
Effective date: 2 September 2026
Last verified: 2 September 2026
1. Core service providers
Vercel Inc.
Purpose: Website hosting, content delivery, serverless functions, deployment, security controls and operational logging.
Data that may be processed: Network and device information, request metadata, service payloads submitted to server functions, and operational logs necessary to deliver and secure the service.
Use status: Active core infrastructure.
Supabase, Inc.
Purpose: Managed PostgreSQL database, authentication support, private object storage and related backend infrastructure.
Data that may be processed: Account and team-access information, customer and project records, legal-acceptance evidence, privacy requests, application data, uploaded files, executed-document archives and metadata, B2B research/source evidence, workflow state, approvals and audit records where a tool requires them.
Use status: Active core infrastructure.
OpenAI, L.L.C.
Purpose: AI-assisted generation, extraction, analysis, classification, research qualification and related requested functions.
Data that may be processed: Prompts, instructions, selected customer content, extracted document text, public-source evidence, research context and requested output context, limited to what is needed for the relevant function.
Use status: Active AI provider at the date of this register. The configured provider may change only through the controlled provider-settings process, and this register must be updated before a materially different provider is used for customer-data processing.
2. Conditional service providers
The following providers are used only when the relevant feature is configured or invoked.
Resend, Inc.
Purpose: Transactional and governed service-email delivery, including inquiries, booking confirmations, privacy requests, account or team invitations, verification and approval messages, service communications, and delivery of executed or signed documents where enabled.
Data that may be processed: Recipient name and email address, organisation, message or request details, verification or transaction references, filenames and document-delivery metadata, and the content of an email attachment such as an executed NDA when the authorised delivery workflow is used.
Use status: Conditional on the relevant email-delivery configuration and workflow being enabled.
Apify Technologies s.r.o.
Purpose: Public-source and business-to-business research workflows, including configured LinkedIn and Reddit research actors.
Data that may be processed: Search criteria, public professional or business information, public posts, source URLs, public evidence and collection metadata.
Use status: Conditional on the research feature and provider credential being enabled.
3. Independent third-party sources
Some research tools may retrieve information from independent public or authorised sources. Current or supported source categories include official procurement/opportunity sources such as UK Contracts Finder and SAM.gov, and public or authorised sources such as Hacker News, Reddit and configured LinkedIn research. These sources operate under their own terms and privacy notices and are not represented as 4TRAITS subprocessors merely because a lawful public, official or authorised interface is queried.
Where a third-party collection provider such as Apify is used to access or process a source on behalf of 4TRAITS, that provider is separately identified above.
4. Providers supported but not currently active
The platform code can support additional AI providers, including Anthropic, Google, Mistral, Groq and OpenRouter. They are not listed as current subprocessors unless activated for customer-data processing.
Stripe libraries are present in the application dependencies, but no live payment-processing workflow was identified in the production implementation reviewed for this register. Stripe must be added to this register and the relevant payment/privacy notices reviewed before live payment processing begins.
5. Provider changes
4TRAITS may replace or add providers where reasonably necessary for service delivery, security, resilience or performance. The register will be updated before or when a material provider change takes effect. Business customers will receive advance notice where their agreement or applicable law requires it.
A provider becoming technically supported does not by itself make it an active subprocessor. Activation for customer-data processing is a legal-review trigger.
6. Safeguards and international processing
Provider processing locations may vary. 4TRAITS applies contractual, technical and organisational safeguards appropriate to the service and follows the international-transfer approach described in the Privacy Policy. UAE-only processing is not promised unless a signed agreement expressly requires it.
7. Questions and objections
Questions about this register or a proposed provider change may be sent to care@4traits.io. A privacy request may also be submitted through the privacy request portal.