Skip to main content
AIRIN
PricingSign in
TRUST & METHODOLOGY

AI Connections: who touches your data

Every AI vendor in your stack runs on someone else’s models, cloud and subprocessors — and those vendors are part of your data’s attack surface. This map shows those links, sourced only from what a company has made public: its own subprocessor lists, trust center, filings, or an on-the-record statement. Every line carries the exact words, the date, and a link back to the source. Our own inferences never count.

17 of 124 AI tools we checked disclose using another company’s AI model (13.7%) — as of Sep 25, 2026How we counted · hosting and integrations alone don’t count

  • 17 disclose using another company’s model
  • 1 say they run their own models
  • 38 no public disclosure found
  • 68 claims found that didn’t meet our proof bar
  • 1 shut-down tools left out of the count

* We found a mention, but the quote didn't clearly state the connection, so it isn't counted or shown.

AI supply chain

305 connections shown

Every connection, with its source

305 connections, each with its public source.
ConnectionTypeSourceDateEvidence
Doe says it runs on AWS“5.2 Service Providers. We engage trusted third-party vendors to perform services on our behalf, including cloud hosting (e.g., AWS, GCP), payment processing, customer support software, analytics tools, and security services. These vendors are contractually bound to process data only as directed by Doe Labs and to maintain appropriate security…”Hosted onAnnounced · Company policy pagepage checked Jul 20, 2026Read the source for: Doe says it runs on AWS (opens in a new tab)
Doe says it runs on Google Cloud“5.2 Service Providers. We engage trusted third-party vendors to perform services on our behalf, including cloud hosting (e.g., AWS, GCP), payment processing, customer support software, analytics tools, and security services. These vendors are contractually bound to process data only as directed by Doe Labs and to maintain appropriate security…”Hosted onAnnounced · Company policy pagepage checked Jul 20, 2026Read the source for: Doe says it runs on Google Cloud (opens in a new tab)
Writesonic says it runs on AWS“Sub-processors Cloud hosting (Microsoft Azure, AWS), Model Providers (OpenAI, Anthropic, Azure, others), CRM, helpdesk, error monitoring, analytics, billing, email Provide and operate the Services Affiliates Writesonic group entities Internal operations, support…”Hosted onAnnounced · Company policy pagepage checked Jun 7, 2026Read the source for: Writesonic says it runs on AWS (opens in a new tab)
Writesonic says it runs on Microsoft Azure“Sub-processors Cloud hosting (Microsoft Azure, AWS), Model Providers (OpenAI, Anthropic, Azure, others), CRM, helpdesk, error monitoring, analytics, billing, email Provide and operate the Services Affiliates Writesonic group entities Internal…”Hosted onAnnounced · Company policy pagepage checked Jun 7, 2026Read the source for: Writesonic says it runs on Microsoft Azure (opens in a new tab)
Writesonic lists OpenAI as a subprocessor“Sub-processors Cloud hosting (Microsoft Azure, AWS), Model Providers (OpenAI, Anthropic, Azure, others), CRM, helpdesk, error monitoring, analytics, billing, email Provide and operate the Services Affiliates Writesonic group entities Internal operations, support, sales, billing …”SubprocessorAnnounced · Company policy pagepage checked Jun 7, 2026Read the source for: Writesonic lists OpenAI as a subprocessor (opens in a new tab)
Writesonic lists Anthropic as a subprocessor“Sub-processors Cloud hosting (Microsoft Azure, AWS), Model Providers (OpenAI, Anthropic, Azure, others), CRM, helpdesk, error monitoring, analytics, billing, email Provide and operate the Services Affiliates Writesonic group entities Internal operations, support, sales, billing Integrations…”SubprocessorAnnounced · Company policy pagepage checked Jun 7, 2026Read the source for: Writesonic lists Anthropic as a subprocessor (opens in a new tab)
Writesonic lists Stability AI as a subprocessor“…OpenAI , Anthropic , Microsoft Azure OpenAI Service , Microsoft Azure for Anthropic models, custom models hosted by Writesonic on Microsoft Azure and Amazon Web Services , Stability AI , OpenRouter , Google Cloud Platform , and other model providers selected from time to time depending on the relevant use case (collectively, "Model Providers"). The applicable Model Provider for a given…”SubprocessorAnnounced · Company policy pagepage checked Jul 10, 2026Read the source for: Writesonic lists Stability AI as a subprocessor (opens in a new tab)
Cartesia lists Stripe as a subprocessor“We use Stripe, Inc. and its affiliates as our third-party service provider for payment services (e.g., card acceptance, merchant settlement, and related services) (“Payment Service Provider”). If you subscribe to any of our…”SubprocessorAnnounced · Company policy pagepage checked Jun 8, 2026Read the source for: Cartesia lists Stripe as a subprocessor (opens in a new tab)
Denta lists Anthropic as a subprocessor“We provide the AI Products through third-party service providers ( " AI Service Providers " ), including Anthropic . As outlined in this Privacy Notice, your input, output, and personal information will be shared with and processed by these AI Service Providers to enable your use of our AI Products for purposes outlined…”SubprocessorAnnounced · Company policy pagepage checked Sep 25, 2026Read the source for: Denta lists Anthropic as a subprocessor (opens in a new tab)
Typeface lists Stripe as a subprocessor“We currently use Stripe as our third party service provider for payment services, and by using our Service you agree to be bound by Stripe’s Services Agreement, available at .”SubprocessorAnnounced · Company policy pagepage checked Jun 7, 2026Read the source for: Typeface lists Stripe as a subprocessor (opens in a new tab)
Dartboard Energy says it runs on AWS“Cloud infrastructure. We use cloud hosting providers (e.g., AWS) to operate the service. Customer data is encrypted in transit and at rest.”Hosted onAnnounced · Company policy pagepage checked Jul 20, 2026Read the source for: Dartboard Energy says it runs on AWS (opens in a new tab)
Hypercubic lists Google Cloud as a subprocessor“We provide the AI Products through third-party service providers ("AI Service Providers"), including Anthropic, OpenAI and Google Cloud AI. As outlined in this Privacy Notice, your input, output, and personal information will be shared with and processed by these AI Service Providers to enable your use of our AI Products for purposes…”SubprocessorAnnounced · Company policy pagepage checked Jul 20, 2026Read the source for: Hypercubic lists Google Cloud as a subprocessor (opens in a new tab)
Hypercubic lists OpenAI as a subprocessor“We provide the AI Products through third-party service providers ("AI Service Providers"), including Anthropic, OpenAI and Google Cloud AI. As outlined in this Privacy Notice, your input, output, and personal information will be shared with and processed by these AI Service Providers to enable your use of our AI Products for…”SubprocessorAnnounced · Company policy pagepage checked Jul 20, 2026Read the source for: Hypercubic lists OpenAI as a subprocessor (opens in a new tab)
Hypercubic lists Anthropic as a subprocessor“We provide the AI Products through third-party service providers ("AI Service Providers"), including Anthropic, OpenAI and Google Cloud AI. As outlined in this Privacy Notice, your input, output, and personal information will be shared with and processed by these AI Service Providers to enable your use of our AI…”SubprocessorAnnounced · Company policy pagepage checked Jul 20, 2026Read the source for: Hypercubic lists Anthropic as a subprocessor (opens in a new tab)
Lovable says it runs on Supabase“Infrastructure Provider(s)" means third-party providers of hosting, database, storage, networking, or related infrastructure services we use to provide Lovable Cloud (for example, Supabase). "Lovable Cloud" means our optional cloud hosting and back-end environment, which may include database hosting, authentication, file and object storage, and API endpoints. Lovable Cloud is provisioned on…”Hosted onAnnounced · Company policy pagepage checked Jun 7, 2026Read the source for: Lovable says it runs on Supabase (opens in a new tab)
Cursor lists Stripe as a subprocessor“4.3. Payment Processing. To facilitate payment for the Service via bank account, credit card, or debit card, we use Stripe, Inc. and its affiliates (“ Stripe ”), a third-party payment processor. These payment processing services are provided by Stripe and are subject to the Stripe terms and conditions and other policies available…”SubprocessorAnnounced · Company policy pagepage checked Aug 14, 2026Read the source for: Cursor lists Stripe as a subprocessor (opens in a new tab)
Magical lists Stripe as a subprocessor“To facilitate payment for the Services we use Stripe, Inc. and its affiliates (“Stripe”), a third-party payment processor. These payment processing services are provided by Stripe and are subject to the Stripe terms and conditions and other policies available at…”SubprocessorAnnounced · Company policy pagepage checked Jun 8, 2026Read the source for: Magical lists Stripe as a subprocessor (opens in a new tab)
Lovable lists OpenAI as a subprocessor“…models and other machine learning models, in order to generate code, content, or other outputs. These systems may be provided by us, by Third-Party AI Providers (such as OpenAI, Google, or OpenRouter), or by models that you connect yourself. By using the Services, you consent to these transfers, processing, and storage.”SubprocessorAnnounced · Company policy pagepage checked Jun 7, 2026Read the source for: Lovable lists OpenAI as a subprocessor (opens in a new tab)
Char says it runs on AWS“Amazon Web Services (AWS) Cloud hosting and storage (US region) All cloud-stored Customer Content and account data Stytch Authentication and identity Email, authentication tokens, device metadata Stripe Payment…”Hosted onAnnounced · Company policy pagepage checked Sep 24, 2026Read the source for: Char says it runs on AWS (opens in a new tab)
Char lists Stripe as a subprocessor“(AWS) Cloud hosting and storage (US region) All cloud-stored Customer Content and account data Stytch Authentication and identity Email, authentication tokens, device metadata Stripe Payment processing Billing details, card data (handled by Stripe directly) Recall.ai Meeting bots for video calls Meeting audio (transient), meeting…”SubprocessorAnnounced · Company policy pagepage checked Sep 24, 2026Read the source for: Char lists Stripe as a subprocessor (opens in a new tab)
Maven Bio lists Stripe as a subprocessor“…and page views to help us analyze how our users interact with our website/app. This data is used solely to enhance the user experience and for internal analytics. We use Stripe, a third-party payment processor, to handle all payment transactions securely on our platform. When you make a payment, Stripe may collect personal information, such as your name, email address, billing address…”SubprocessorAnnounced · Company policy pagepage checked Sep 25, 2026Read the source for: Maven Bio lists Stripe as a subprocessor (opens in a new tab)
Runway lists Stripe as a subprocessor“17.1 Third Party Service Provider. The Company uses Stripe, Inc. and its affiliates as the third party service provider for payment services (e.g., card acceptance, merchant settlement, and related services) (a “ Third Party Service Provider ”). By buying or selling on…”SubprocessorAnnounced · Company policy pagepage checked Jul 19, 2026Read the source for: Runway lists Stripe as a subprocessor (opens in a new tab)
Compyle lists Google Cloud as a subprocessor“…products, features, and tools powered by artificial intelligence ("AI Products"). We provide AI Products through third-party AI service providers, currently Anthropic and Google Cloud AI. Input you provide to AI Products, the output generated, and associated personal information are processed by these providers on our behalf, subject to our agreements with them, to enable your use of…”SubprocessorAnnounced · Company policy pagepage checked Jul 20, 2026Read the source for: Compyle lists Google Cloud as a subprocessor (opens in a new tab)
Compyle lists Anthropic as a subprocessor“…platform offers products, features, and tools powered by artificial intelligence ("AI Products"). We provide AI Products through third-party AI service providers, currently Anthropic and Google Cloud AI. Input you provide to AI Products, the output generated, and associated personal information are processed by these providers on our behalf, subject to our agreements with them, to…”SubprocessorAnnounced · Company policy pagepage checked Jul 20, 2026Read the source for: Compyle lists Anthropic as a subprocessor (opens in a new tab)
Pictory AI lists Stripe as a subprocessor“By providing payment information, you authorize Pictory and its third-party payment processors (e.g., Stripe) to charge all applicable fees to your designated payment method. Payment processing services are subject to the terms and conditions of the applicable payment processor, and Pictory is not responsible for such…”SubprocessorAnnounced · Company policy pagepage checked Jun 7, 2026Read the source for: Pictory AI lists Stripe as a subprocessor (opens in a new tab)
Showing 25 of 305

Know a connection we’re missing? Tip us.

Point us to where a company said it publicly: a policy page, announcement, filing, interview, podcast or post. We review every tip before anything goes public, and we only publish a connection when we can link to that public source ourselves. Who sent a tip always stays private.

Where the company (or a reporter quoting it) says so.
Private, never shown, only used if we need to ask a question about your tip.

How we source connections

What counts

A company’s own words — subprocessor lists, trust centers, docs, blog posts, press releases — official filings and government records, and on-the-record statements in news interviews, podcasts, videos and social posts by the company or its people. Each connection needs a link, the exact quote (or a timestamp for audio and video), and the source’s own date.

What doesn’t

Our inferences, “reading between the lines”, third-party security-review or aggregator sites, and undated news or posts. If the quote doesn’t name the other company, it isn’t a connection. Tips are leads, never evidence — a tip only becomes a line once we find the public source ourselves.

How we checked

Every connection passes an automated source check, a live link check within the last 14 days, and an independent review by a second AI system from a different company confirming the quote says what the line claims. Labels tell you the source: Filed, Announced (the company itself), or Reported (press, podcast or post).

Why procurement, security and compliance teams use this

A vendor’s privacy and security promises only cover what they control directly. If your AI vendor is hosted on someone else’s cloud, or built on another company’s model, your data’s exposure runs through every hop in that chain — each one is a party who can touch it. This map exists so you can see that chain before you sign, not after an incident. Pair it with AIRIN’s platform ratings for how each vendor itself handles prompts, outputs and training data.

Something wrong or out of date? Send a correction with the source and we’ll review it.

Embed this map

Free to embed with attribution. The map updates itself as we add sourced connections. Add ?focus= and a company’s slug to open on one vendor, for example https://airinetwork.com/connections/embed?focus=openai.

<iframe src="https://airinetwork.com/connections/embed" title="AI Connections map — who touches your data" width="100%" height="640" style="border:0" loading="lazy"></iframe>

The full data, with every source, is published by The AI List at theail.ist/connections/graph.json. AIRIN mirrors that same feed here — nothing is re-derived.

📢 POLICY UPDATES ALERT

AIRIN Brief

Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.