Legal
Subprocessors
Last Updated: April 20, 2026
To deliver the Services, PensarAI, Inc. ("PensarAI," "we," "us," or "our") engages a limited set of third-party service providers ("Subprocessors") that may process Customer Personal Data on our behalf. This page lists our current Subprocessors and describes how we notify customers of changes.
Capitalized terms not defined on this page have the meanings given to them in our Terms of Service or our Data Processing Addendum ("DPA"). In the event of any conflict between this page and the DPA, the DPA governs.
1. CURRENT SUBPROCESSORS
PensarAI currently uses the following Subprocessors to assist in the provision of the Services:
| Subprocessor | Purpose | Location |
|---|---|---|
| Amazon Web Services (AWS) | Cloud infrastructure and hosting | United States |
| Anthropic | AI model inference for autonomous adversarial testing capabilities | United States |
| Cloudflare | Content delivery network and edge security | United States |
| Stripe | Payment processing and billing | United States |
| WorkOS | Authentication and user management | United States |
2. CONTRACTUAL SAFEGUARDS
Each Subprocessor listed above is bound by its own publicly available data processing terms and security commitments, which PensarAI reviews before engaging the Subprocessor. PensarAI selects Subprocessors that maintain appropriate technical and organizational safeguards consistent with industry standards and applicable data protection laws.
Customer Data containing vulnerability findings, credentials, or network configurations is protected by enhanced safeguards, including logical separation, encryption (AES-256 at rest and TLS 1.2+ in transit), and strict role-based access controls.
3. NOTICE OF NEW SUBPROCESSORS AND RIGHT TO OBJECT
When PensarAI wishes to engage a new Subprocessor, we will provide Customer reasonable notice prior to giving the new Subprocessor access to Customer Personal Data.
Customer may, on the basis of reasonable data privacy or data security concerns, object to PensarAI's use of a new Subprocessor by providing PensarAI with written notice of the objection within fifteen (15) days of the date of such notice. If Customer does not object within that period, Customer is deemed to consent to the new Subprocessor.
If Customer objects, PensarAI and Customer will work together in good faith to find a mutually acceptable resolution.
4. STAYING INFORMED OF UPDATES
To receive notice of updates to this list of Subprocessors, or to request a copy of our Data Processing Addendum, please contact us at team@pensarai.com.
[End of Subprocessors]