Trust Center

Subprocessor List

Last Updated: June 2026

Overview

RequirementsHub uses the third-party service providers listed below to operate our platform. Each subprocessor has been evaluated for their security posture and data handling practices. We update this page when subprocessors are added or removed and notify workspace owners with active Pro or Enterprise subscriptions at least 30 days before a new subprocessor begins processing customer data, except where a change is required for security or legal reasons, in which case notice will follow as soon as practicable.

To subscribe to subprocessor change notifications, email security@requirementshub.ai with subject line "Subprocessor Notifications."

Infrastructure & Platform

Subprocessor	Purpose	Data Categories Processed	Hosting Region	Privacy / Security Reference
Cloudflare, Inc.	Application runtime (Cloudflare Workers), edge routing, DDoS protection, TLS termination	Request metadata, payload in transit (not stored at edge)	United States (global edge; compute runs in US regions)	cloudflare.com/privacypolicy · SOC 2 Type II
Lovable Technologies	Application build and deployment platform	Source code, deployment artifacts, platform-level logs	European Union	lovable.dev/privacy
Supabase, Inc.	Relational database (PostgreSQL), file storage, authentication, row-level access control	Account data, project content, requirements, workspace data, uploaded documents, auth credentials (hashed)	United States (AWS us-east-1)	supabase.com/privacy · SOC 2 Type II

Payments

Subprocessor	Purpose	Data Categories Processed	Hosting Region	Privacy / Security Reference
Stripe, Inc.	Payment processing, subscription billing	Payment card data, billing address, invoice history	United States / EU (Stripe-managed)	stripe.com/privacy · PCI DSS Level 1

RequirementsHub does not store, transmit, or have access to raw payment card data. All card processing is handled exclusively by Stripe.

Artificial Intelligence & Machine Learning

Subprocessor	Purpose	Data Categories Processed	Hosting Region	Training Use
Anthropic, PBC	Primary AI model (Claude) — requirements analysis, intelligence scoring, artifact generation	Requirements text, project content submitted for analysis	United States	Not used for model training. Anthropic API enterprise terms prohibit use of submitted data for training.
OpenAI, LLC	Secondary AI model (GPT) — repair and fallback processing pipelines	Requirements text submitted for processing	United States	Not used for model training. OpenAI API terms prohibit use of API data for training.
Google LLC (via Lovable AI Gateway)	Tertiary AI fallback — Gemini 2.5 Pro, invoked only when primary and secondary models are unavailable	Requirements text submitted for processing (failover path only)	United States	Not used for model training. Google Cloud API terms prohibit use of API data for training. This path is activated only during primary model failover.

RequirementsHub routes AI processing through Anthropic (primary), OpenAI (secondary repair), and Google Gemini (tertiary fallback via Lovable AI Gateway). All three providers operate under API terms that prohibit using submitted data to train their models. Your requirement content is never used to improve any AI model.

Communications

Subprocessor	Purpose	Data Categories Processed	Hosting Region	Privacy / Security Reference
Mailgun (Sinch)	Inbound and outbound transactional email (invitations, notifications, password reset, email-to-workspace features)	Email address, email content, sender metadata	United States	mailgun.com/privacy-policy

Analytics & Monitoring

No third-party analytics provider is currently in use. RequirementsHub does not embed any third-party analytics, session recording, or advertising tracking. Platform-level analytics provided by Lovable Technologies are subject to their privacy terms above.

Data Residency

Customer data at rest is stored in Supabase on AWS us-east-1 (Northern Virginia). We do not currently offer tenant-level region selection. Enterprise customers with data residency requirements should contact sales@requirementshub.ai to discuss options.

Subprocessor Change History

Date	Change
June 2026	Initial publication of subprocessor list

Questions

Contact security@requirementshub.ai.

Last updated: June 2026