Sub-processors
Effective date: May 13, 2026 · Custodia, LLC
Custodia, LLC uses the U.S.-based sub-processors listed below to operate the BidFedCMMC platform (the “Service”). All processing locations listed are in the contiguous United States. Each sub-processor is bound by a written agreement that obligates it to confidentiality and to security measures appropriate to the data it handles.
Current sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Vercel Inc. | Application hosting, edge runtime, blob object storage. | USA |
| Neon Inc. | Managed PostgreSQL database hosting. | USA |
| Amazon Web Services, Inc. | AWS Key Management Service for envelope encryption of customer data. | USA (us-east region) |
| Clerk, Inc. | User authentication, session management, MFA. | USA |
| Stripe, Inc. | Payment processing for subscriptions. | USA |
| Resend, Inc. | Transactional email delivery (account, billing, security notices). | USA |
| Anthropic, PBC | AI inference for Charlie compliance assistant. Zero-retention API; not used for model training. | USA |
| OpenAI, L.L.C. | AI inference for selected features. Zero-retention API; not used for model training. | USA |
| Functional Software, Inc. d/b/a Sentry | Application error monitoring. | USA |
Changes and notice
We will post material additions or replacements to this list at least thirty (30) days before a new sub-processor begins processing customer data. To receive change notifications, email legal@bidfedcmmc.com with the subject line “Subprocessor notifications.”