The Arabic version of this document is the authoritative legal text. This English translation is provided for convenience; in case of any discrepancy, the Arabic version prevails.
Sub-processors
Effective: 16 July 2026
This page lists the third-party sub-processors MainCore Technologies engages to process personal data through CoreShield AI. It mirrors Annex A of our Data Processing Agreement; Microsoft Azure and OpenAI were verified against the deployed pilot configuration on 2026-08-08, and Resend was added on 2026-10-11 after verification against the deployed configuration (transactional email and alert delivery) — only sub-processors genuinely in use are listed.
Current sub-processors
| Sub-processor | Purpose | Data category received | Hosting region |
|---|---|---|---|
| Microsoft Azure | Cloud hosting: compute, storage, managed PostgreSQL, and Key Vault (encryption-key custody). All platform infrastructure runs here. | All platform data. Detected sensitive values are AES-256-GCM encrypted at rest in the vault; values the detection does not recognise — notably some personal names — can remain in the cloaked text as written. | UAE North — current pilot. [OWNER DECISION: production/sovereign hosting region — the pilot runs in Azure UAE North; real customer data will be hosted inside the Kingdom of Saudi Arabia, provider under evaluation] |
| OpenAI | External LLM inference (model gpt-4o-mini) for the Send verb. | Cloaked text: detected sensitive values are replaced with tokens before sending; values the detection does not recognise — notably some personal names — can reach the provider as written. | [OWNER DECISION: OpenAI API data-processing region + signed OpenAI DPA] |
| Resend | Transactional email delivery: account invitations, password reset, and alert emails. | Recipient email address and message content. | Per the provider's terms. |
Not currently engaged
The following are not in use in the deployed pilot as of 2026-08-08 and must not be treated as active sub-processors until enabled: Anthropic, Google (Gemini), and Azure OpenAI (alternative LLM providers — not configured); AWS and STC Cloud (STC Cloud is a candidate in-Kingdom host under evaluation, not yet deployed); and any analytics or error-tracking service (none is deployed).
Changes
We will give 30 days' notice of any new sub-processor via the mechanism in the Data Processing Agreement, during which a customer may object.
This document requires a Saudi lawyer's sign-off before publication.