Subprocessors
The third parties RFP.co engages to process customer data, what each one receives, where it processes, and how to be notified before the list changes.
Last updated August 8, 2026
Governed by Arkansas law
These are the vendors RFP.co engages to help provide the platform, and exactly what each one receives. The list is maintained as the authoritative record referred to by the Data Processing Addendum. We give 30 days’ notice before adding one, and a customer who objects on reasonable data protection grounds can terminate the affected service for a refund.
How to read this page
Each entry says what the vendor receives, not what the platform holds. Those are different things and the difference is the point of the exercise: Stripe never sees a proposal, and the model provider never sees a card. A list that described both as “customer data” would be accurate in the way that makes it useless for the assessment it exists to support.
Active means engaged for every customer. Optional means engaged only where a deployment or a workspace turns on the feature that needs it, and the entry says which feature that is.
Active subprocessors
Hetzner Online GmbH
Hosting for the application, the database and the background workers. All customer content is stored on infrastructure operated here.
Receives:
- Everything a workspace stores: accounts, company profiles, opportunities, documents, proposal content, comments, approvals and audit records
Processing location: Germany and Finland (European Union) · www.hetzner.com
Cloudflare, Inc.
Authoritative DNS, TLS termination, content delivery and denial-of-service protection for rfp.co and app.rfp.co.
Receives:
- Request metadata: IP address, user agent, requested URL, TLS handshake
- Page and asset content in transit
Processing location: Global edge network; incorporated in the United States · www.cloudflare.com
Stripe, Inc.
Payment processing, subscription management and invoicing. Stripe is the system of record for every charge; RFP.co mirrors it and never stores a card number.
Receives:
- Billing contact name and email
- Billing address and tax identifiers where collected
- Payment method details, held by Stripe and never by RFP.co
- Subscription, invoice and payment history
Processing location: United States and Ireland · stripe.com
Resend, Inc.
Delivery of transactional email: verification, password reset, invitations, review requests and billing notices.
Receives:
- Recipient name and email address
- The content of the message sent
Processing location: United States · resend.com
Anthropic PBC
The large language model behind classification, requirement extraction and proposal drafting.
Receives:
- The text of the solicitation passages being read
- The company profile and library content a draft is allowed to draw on
- The prompt and the generated draft
Processing location: United States · www.anthropic.com
Optional subprocessors
Engaged only where the relevant feature is configured. If a workspace never uses them, these vendors receive nothing.
Amazon Web Services, Inc.
OptionalObject storage for uploaded documents and rendered proposal packages, where a deployment is configured to use S3 rather than local storage.
Engaged only where object storage is configured; the default deployment stores documents on the application’s own hosts.
Receives:
- Uploaded solicitation documents and attachments
- Rendered proposal exports
Processing location: The AWS region configured for the deployment · aws.amazon.com
Google LLC
OptionalOptional sign-in with Google, and optionally the Programmable Search Engine used by open-web listening.
Sign-in is engaged only when a workspace uses Google to authenticate. Search is engaged only when a deployment configures that provider.
Receives:
- For sign-in: the email address, name and account identifier of the person signing in
- For search: the query terms, which are assembled from public procurement vocabulary and contain no customer content
Processing location: United States · policies.google.com
Open-web search providers
OptionalDiscovery of solicitations published outside procurement portals. RFP.co supports Brave Search, Microsoft Bing, Serper and Google Programmable Search; a deployment configures one or more.
Engaged only where open-web listening is configured for a deployment.
Receives:
- Search queries generated from public procurement vocabulary. No customer content, no account identifiers and no document text is sent to a search provider.
Processing location: United States and European Union, by provider · brave.com/search/api
Sources we read, and send nothing to
The platform retrieves published procurement information from the sources below. They are not subprocessors, because no customer data is disclosed to them: a request carries a date window and, where the source requires one, our own API credential. They are listed because a customer asking where opportunities come from deserves the answer.
- SAM.gov (U.S. General Services Administration) — Federal contract opportunities. RFP.co sends an API key and a date window; no customer data leaves the platform.
- USAspending.gov — Federal award history, used for incumbency and recompete prediction. Requests carry no customer data.
- State, county and municipal procurement portals — Public solicitation listings, retrieved by scheduled poll. Requests carry no customer data.
How a subprocessor is added
- The vendor is assessed for security posture, data protection terms, processing location and transfer mechanism before any contract is signed.
- It is engaged under written terms imposing obligations no less protective than those in our Data Processing Addendum. We stay liable to the customer for its performance.
- This page is updated and subscribers are notified at least 30 days before the vendor begins processing.
- A customer may object on reasonable data protection grounds within that window. If we cannot resolve the objection, that customer may terminate the affected part of the service and receive a pro-rata refund of prepaid unused fees.
That last step is what makes the objection meaningful rather than ceremonial. A notice period with no remedy at the end of it is an announcement, not a right.
Affiliates
RFP.co has no affiliates processing customer data at present. If that changes, they will be listed here on the same notice terms as any other subprocessor.
Contact
Questions about this list, or a request for the diligence we hold on a vendor: privacy@rfp.co.
See what you are not bidding on.
Connect a source, describe what your company does, and look at the opportunities that come back before deciding whether any of this is worth your time.