Sub-processors
Effective date: August 13, 2026 · Custodia, LLC
Custodia, LLC uses the U.S.-based sub-processors listed below to operate the BidFedCMMC platform (the “Service”). All processing locations listed are in the contiguous United States. Each sub-processor is bound by a written agreement that obligates it to confidentiality and to security measures appropriate to the data it handles.
Current sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Vercel Inc. | Application hosting, edge runtime, blob object storage. | USA |
| Neon Inc. | Managed PostgreSQL database hosting. | USA |
| Amazon Web Services, Inc. | AWS Key Management Service for envelope encryption of customer data. | USA (us-east region) |
| Clerk, Inc. | User authentication, session management, MFA. | USA |
| Stripe, Inc. | Payment processing for subscriptions. | USA |
| Resend, Inc. | Transactional email delivery (account, billing, security notices). | USA |
| Anthropic, PBC | AI inference for the Charlie compliance assistant. Zero data retention; not used for model training; no CUI transmitted. | USA |
| Functional Software, Inc. d/b/a Sentry | Application error monitoring. | USA |
Marketing and website vendors
These vendors process information about visitors to our public marketing pages and people who contact us. They are listed here for transparency. None of them receives customer compliance content, evidence, control responses, or attestations from the signed-in Service.
| Vendor | Purpose | Location |
|---|---|---|
| Vercel Inc. (Web Analytics) | Aggregate, cookieless page-view and performance measurement. | USA |
| Apollo.io, Inc. | Identifies the company, and where offered for U.S. visitors the individual, behind a visit to our public pages, so we can follow up with interested organizations. | USA |
| Google LLC | Google Analytics and Google Ads measurement and conversion tracking, active while an advertising campaign is running. | USA |
| LinkedIn Corporation | Insight Tag conversion tracking for LinkedIn advertising, active while a campaign is running. | USA |
| Calendly LLC | Scheduling for advisory and demo calls you request. Receives the name, email, and any details you enter when booking. | USA |
To be excluded from these tools, email privacy@bidfedcmmc.com. See our Cookie notice for the browser and provider level controls.
Changes and notice
We will post material additions or replacements to this list at least thirty (30) days before a new sub-processor begins processing customer data. To receive change notifications, email legal@bidfedcmmc.com with the subject line “Subprocessor notifications.”