Subprocessors
These are the categories of third-party service that process customer data on behalf of JCIL.AI. Every row says what the service does, what data it receives, and where the processing happens. We name the two providers a member meets directly and describe the rest by role. When this list changes, we update this page and the date at the bottom.
| Service | Purpose | Data received | Region | Policy |
|---|---|---|---|---|
| Anthropic | Inference for our primary model: Claude models by Anthropic, Claude Sonnet 5.5 for conversations, Claude Opus 5.5 for the hardest questions, and Claude Haiku 5.5 for background helpers; native web search when a turn needs live results; and sandboxed document generation on Anthropic-hosted containers | User messages, system prompts, attached images and documents passed to the model; the search queries the model composes on search turns. Not used for training; retained briefly by Anthropic for abuse monitoring under its commercial terms | United States; compute may route | View |
| AI model hosting (backup) | Inference for our backup model, a frontier open-weight model, hosted and processed in the United States of America by an American company, on infrastructure we selected and configured, through a US-only serving path. Used only while Claude is unavailable, and disclosed on screen while it is in use. Zero data retention: prompts and answers live only in volatile memory for the length of the request. ISO 27001, ISO 27701 and ISO 42001 certified, SOC 2 Type II audited | Only the turns answered while the backup is on: your messages, the system prompt, and any attachment passed with them. Not used for training, and not retained on the endpoint we use | United States | On request |
| Web search provider | Live search results when a conversation needs them while the backup model answers, research for some documents, and the headlines gathered by scheduled routines | The search query text only. No account identifier, no conversation content | United States | On request |
| Speech and embeddings provider | Voice dictation transcription for hold-to-speak, text embeddings for memory and document search, and a safety screen on images you attach to a chat (the image is checked before the assistant sees it; a refused image is deleted). It never answers a conversation | Recorded audio clips when you use hold-to-speak; memory text and document passages sent for embedding. Not used for training under the provider's API terms | United States; compute may route | On request |
| Database and authentication hosting | Managed database and sign-in service | Profiles, conversations, messages, memories, billing transactions. Encrypted at rest | United States | On request |
| Application hosting and file storage | Serving the app, edge middleware, DNS, and storage for uploaded files | Request metadata, uploaded files. Encrypted at rest | United States | On request |
| Stripe | Payment processing (subscription and credits) | Name, email, payment method (card numbers never touch JCIL.AI servers) | United States | View |
| Transactional email | Welcome, receipts, and account alerts | Email address, message content | United States | On request |
| Rate-limit store | Counters for rate limiting and the provider lane setting | Rate-limit counters keyed by user ID or IP; no message content | United States | On request |
| App connections platform | Third-party app connectors (Gmail, Calendar, and others) only when a user connects them | Only what the requested action requires | United States | On request |
| Bot protection | A challenge on the sign-in and sign-up forms only, never on a conversation | IP address, user agent, and browser signals collected by the challenge | United States | On request |
| Weather data | Forecasts when you ask about the weather | A city name or a pair of coordinates. Nothing that identifies you | EU-operated public API | On request |
| Image generation provider | Photographs for the slide decks the assistant builds, generated by an American AI image model provider from short scene descriptions the assistant writes (a sunrise over a lake, a church kitchen) and styled to the deck's look. Used only when a deck is built or revised, never in a conversation, and never for people's faces | The scene descriptions the assistant writes for the slides. Never your messages, your documents, or the words on the deck | United States | On request |
| Scripture text provider | Verbatim Scripture text in the translation you choose (King James Version by default), served by API.Bible, a service of the American Bible Society | The passage reference you asked for, such as John 3:16. Nothing else | United States | On request |
| Error monitoring | Application error monitoring | Error traces and request metadata, and on an error a session replay with text and inputs masked | United States | On request |
Where your data lives
Everything we store about you is held in the United States (your account, your conversations, your memory, your documents), and every company that stores your data is American. The two lookup services above (weather and Scripture) receive no personal data at all: a city name or a passage reference, nothing tied to you.
Your prompts and answers are never used to train any model, by us or by any service above. Anthropic, which serves our primary model, retains API inputs and outputs for a limited period for abuse monitoring under its commercial terms and does not train on them; its privacy documentation linked above has the specifics. The provider that hosts our backup model keeps zero data retention on the endpoint we use.
When Claude is unavailable
JCIL runs on Claude by Anthropic, an American AI company. If Claude is ever unavailable, JCIL switches to one alternative, its backup: a frontier open-weight model hosted and processed in the United States, on infrastructure we selected and configured. We tell you on screen for as long as the switch is on: a notice above your conversation, and a label on each answer the backup wrote. The company that made the backup model's weights receives nothing: the model runs on infrastructure in the United States, and your conversation is never sent to the model's maker. The switch is made by us, or automatically after repeated failures of Claude, and we return to Claude as soon as we can.