Goldilocks AI Sub-processors
Last updated: July 10, 2026
Goldilocks AI, Inc. ("Goldilocks") uses the following sub-processors to process Submitted Data on behalf of customers. We assess each provider's security posture and data-protection terms before engagement and bind each to obligations no less protective than our Data Processing Addendum. We update this page when we add or replace a sub-processor; customers receive notice of changes as described in our Data Processing Addendum (goldi.ai/dpa).
| Sub-Processor | Location | Description of Processing |
|---|---|---|
| Google Cloud | United States | Cloud infrastructure, hosting, and backend processing |
| Google (Gemini API) | United States | AI query interpretation, profile summarization and assessment; no training on inputs |
| Supabase | United Kingdom | Database and authentication |
| Vercel | United States | Frontend application delivery |
| Stripe | United States | Payment processing (billing data) |
| Google Workspace | United States | Support and business communications |
| PostHog | United States | Product analytics and usage measurement |
| Anthropic | United States | Engineering analysis and quality evaluation of queries and Service outputs (no training on inputs) |
Transfers outside the UK/EU are protected by the safeguards described in our Data Processing Addendum (goldi.ai/dpa): the EU-US Data Privacy Framework and its UK Extension for certified providers, or the EU Standard Contractual Clauses with the UK Addendum.
Providers that process only Goldilocks-controlled profile data (such as contact verification and public-web search retrieval) act for Goldilocks as an independent controller and are not sub-processors of customer data; those categories are described in our Privacy Policy.