Sub-processor list — Silkroute AI CFO
Version: 2026-10-31-draft · Date:
DRAFT — must be reviewed by a lawyer before it binds anyone (Law of the Republic of Uzbekistan “On Personal Data”). Text in [square brackets] is a placeholder.
How to read this list
Each entry gives the service provider, what it does for us, which data it receives and where. AI providers and connectors receive data only if you give the matching consent.
Neon (database hosting)
Stores all service data in PostgreSQL. Location: [DB REGION].
Railway (API hosting)
Runs our API, which processes all service data in memory while handling requests. Location: [API REGION].
Vercel (website and app hosting)
Serves our web pages; receives IP addresses and request details in its logs. Location: global edge network.
Cloudflare (DNS and web application firewall, when enabled)
Routes and filters traffic; receives IP addresses and request details. Location: global network.
AI providers: Google (Gemini), Groq, OpenRouter, Anthropic
Answer AI CFO questions. They receive only pseudonymised aggregates and the minimum rows a question needs, and only with your AI consent. Your uploaded data goes only to paid tiers whose terms forbid training on it; OpenRouter is used only with providers that do not log prompts. Location: mainly the United States.
Payme and Click (payments)
Process card payments for paid plans; they handle the card details, we receive only the payment status and a token. Location: Republic of Uzbekistan.
Merchant of record for USD payments [MERCHANT OF RECORD] (only when enabled)
Sells the subscription to customers outside Uzbekistan and processes their card payment; receives the e-mail and payment details you enter on its page. Location: [MOR REGION].
Resend (e-mail, only when enabled)
Delivers the feedback you send us to our inbox; receives your message and the contact e-mail you add. Location: [EMAIL REGION].
Telegram (bot, only if you link it)
Delivers messages between you and the Silkroute bot, including statement files you send to it. Location: global.
Google (Sheets, Drive, Gmail connectors, only if you connect them)
Lets you import statements and export reports with the access you approve. Location: global.
Not used yet. When transactional email is added, the provider will be listed here: [EMAIL PROVIDER].
Localisation
Storing Uzbek citizens’ personal data on servers in the Republic of Uzbekistan, as the Law “On Personal Data” requires, must be arranged before commercial use; this list will then name the local provider.