Legal
Subprocessors
Last updated: July 16, 2026. These third parties process data on Norami's behalf to deliver the service. We require each subprocessor to be bound by applicable data-processing terms before it handles customer personal data. We give workspace owners at least ten business days' notice before adding or replacing a subprocessor, with a right to object on reasonable grounds.
| Subprocessor | Purpose | Location |
|---|---|---|
| Anthropic | AI model processing — generating answers from your data | United States |
| OpenAI | AI model processing and text embeddings | United States |
| Cohere | AI reranking of retrieved document excerpts | Canada (service provider); United States (hosting) |
| LlamaIndex (LlamaParse) | Document parsing and OCR for uploaded files | United States (EEA region available) |
| E2B | Sandboxed code execution for data analysis | United States |
| Supabase | Application database, authentication, and file storage | United States |
| WorkOS | Optional enterprise SSO and directory synchronization for authentication and account provisioning | United States |
| Vercel | Application hosting and serverless compute | United States (global edge) |
| Railway | Spreadsheet ingestion worker — parses uploaded spreadsheets into the queryable row index | United States |
| Cloudflare | Network, DNS, and the secure data-ingestion tunnel | Global |
| Sentry | Application error monitoring and crash reporting | United States |
| Stripe | Payment processing and subscription billing | United States |
| Resend | Transactional email delivery | United States |
| Perplexity | Optional business-context research at onboarding | United States |
We update this list as the service evolves. To request our Data Processing Addendum or to ask about a subprocessor, contact privacy@norami.ai. See also our Privacy Policy.