Authoritative Sub-processor & Infrastructure Provider Schedule
Document Reference: AUC-LEG-SUB-001
Version: 2.2.0
Effective Date: October 24, 2026
Last Updated: October 24, 2026
Authority: Office of the General Counsel & CISO, Auctoric, LLC
Classification: Public Regulatory Schedule
Governing Standard: GDPR Article 28 | CCPA / CPRA | HIPAA HITECH | NIST SP 800-53 SA-9
Executive Summary (ISO 24495-1 Plain-Language Overview)
[!IMPORTANT] Legal Precedence Notice: This plain-language summary is provided solely for reader convenience and vendor due diligence navigation pursuant to ISO 24495-1:2023. It does not supersede or alter the operative terms of the Data Processing Addendum or Master Services Agreement.
- Core Scope: Enumerates all external cloud hyperscalers, foundation model inference APIs, and operational monitoring vendors authorized to process or store customer data.
- Hosting Hyperscalers: Core container orchestration, FIPS 140-3 key management, and immutable audit logs are hosted in Google Cloud Platform (US regions) and AWS GovCloud (defense sovereign enclaves).
- Foundation Model Zero-Retention: All routed inference across Google Cloud Vertex AI, Microsoft Azure OpenAI, and Anthropic operates under enterprise Zero Data Retention (ZDR) agreements—no customer prompt or output data is ever retained or ingested for base model training.
- 30-Day Advance Notification: Customers receive at least 30 calendar days’ advance written notice prior to the onboarding of any new sub-processor, with full rights to object or terminate affected services without penalty.
High-Intent Procurement FAQ (AEO Direct Answers)
Do Auctoric’s foundation model sub-processors retain or inspect customer prompts?
No. Under Section 3, all foundation model API routes (Google Cloud Vertex AI, Microsoft Azure OpenAI, and Anthropic PBC) are bound by commercial enterprise zero-data-retention (ZDR) agreements. Customer prompts, embeddings, and generated outputs are excluded from provider retention and model training.
How much advance notice does Auctoric give before adding a new sub-processor?
Under Section 5, Auctoric provides at least thirty (30) calendar days’ prior written notice via email and Trust Center announcements before onboarding any new sub-processor, granting customers a 30-day window to object on data protection grounds.
Where are Auctoric’s cloud hosting and data processing facilities located?
Under Section 2 and Section 3, all core platform compute, FIPS 140-3 cryptographic key storage, and foundation model inference execution take place exclusively within Tier III/IV data center facilities in the continental United States.
1. Scope & Purpose
This Authoritative Sub-processor Schedule provides transparent, centralized enumeration of all third-party cloud infrastructure providers, foundation model hyperscalers, and specialized technical services engaged by Auctoric, LLC to deliver the Auctoric platform and associated services.
This Schedule is incorporated by reference into the Auctoric Data Processing Addendum (DPA), Master Services Agreement (MSA), and Global Privacy Policy.
2. Infrastructure & Hosting Sub-processors
The following hyperscale cloud infrastructure providers are engaged to host containerized compute, network boundaries, and encrypted storage:
| Provider Name | Corporate Entity & Jurisdiction | Processing Activity / Service Scope | Data Center Locations | Security Certifications |
|---|---|---|---|---|
| Google Cloud Platform (GCP) | Google LLC (Delaware, USA) |
• Core container orchestration (GKE) • FIPS 140-3 Key Management (Cloud KMS) • Edge WAF and DDoS mitigation (Cloud Armor) • Immutable WORM audit storage |
United States (US-East, US-Central) |
• SOC 1, 2, 3 • ISO/IEC 27001, 27017, 27018 • FedRAMP High • PCI-DSS Level 1 |
| Amazon Web Services (AWS) (Secondary / GovCloud) | Amazon Web Services, Inc. (Delaware, USA) |
• Specialized defense sovereign enclaves • High-availability cross-region backup replication |
United States (GovCloud US) |
• FedRAMP High • DoD IL4 / IL5 • SOC 1, 2, 3 |
3. Foundation Model & AI Inference Providers
Auctoric orchestrates workloads across dedicated enterprise commercial API agreements ensuring Zero Data Retention (ZDR) and Zero Model Training on Customer Data:
| Provider Name | Foundation Model Families | Flow-Down Legal Boundary | Data Ingress / Processing Region | Model Training Policy |
|---|---|---|---|---|
| Google Cloud Vertex AI | Gemini, PaLM | Google Cloud Vertex AI Service Terms | United States | Zero Customer Data Retention; Prompts and outputs are never used to train base models. |
| Microsoft Azure OpenAI | GPT-4o, o1 series | Microsoft Code of Conduct for Azure OpenAI | United States | Enterprise ZDR Exemption; Customer data not retained or inspected by provider. |
| Anthropic PBC | Claude 3, Claude 3.5 | Anthropic Commercial Terms of Service | United States | Commercial Zero Retention; Inputs/outputs excluded from all training pipelines. |
4. Operational Monitoring & Security Assurance Tooling
| Vendor / Tool Name | Service Scope | Data Exposed | Security Posture |
|---|---|---|---|
| BreachBits, Inc. | Continuous external attack surface monitoring & predictive risk scoring | Public domain and external IP addresses only (Zero customer data) | SOC 2 Type II |
| Sigstore / Rekor | Public software transparency ledger for cryptographic commit attestation | Cryptographic hash digests and signing certificates only (Zero payload data) | Linux Foundation Sovereign Standard |
5. Sub-processor Notification & Objection Mechanism
- Advance Notification: Auctoric provides at least thirty (30) calendar days’ prior written notice to customers before onboarding any new sub-processor that processes Customer Personal Data. Notice is provided via email to designated security contacts and posted to the Auctoric Trust Center.
- Right to Object: Customers may object in writing on reasonable data protection grounds within thirty (30) days of receiving notice. If the parties cannot resolve the objection, Customer may terminate the affected Order Form without penalty.
- Sub-processor Due Diligence: Prior to engagement, Auctoric executes comprehensive vendor risk evaluations, verifying SOC 2 Type II or ISO 27001 compliance, FIPS cryptographic conformance, and execution of mandatory Data Processing Addenda with Standard Contractual Clauses (SCCs).
6. Document Administration
- Approved By: Office of the Chief Information Security Officer (CISO) & Legal Counsel
- Effective Date: October 24, 2026
- Verification: Cryptographically sealed under Auctoric Compliance Framework commit baseline.