Subprocessors

1. Introduction and status of this list

Current as at 23 August 2026. This page is the subprocessor list maintained by humanizes, the operator of humanizes.com and referenced in the Privacy Policy and Data Processing Agreement. The effective date at the top is the date of the current list.

A subprocessor is another organisation engaged to process personal data on our behalf when we act as a processor for a customer. Some listed providers also act as independent controllers for parts of their service, such as Stripe’s direct collection of payment-card details. Listing a provider here describes its operational role and does not change the legal allocation in its terms or applicable law.

2. Customer-facing subprocessors and providers

3. Limits on AI processing

Text is used to fulfil your request, not to train models

OpenAI, StealthGPT and GPTZero receive only the text needed to perform the requested feature or its delivery workflow. During paid humanization, GPTZero may receive generated candidate text for scoring; for a provider-backed detector request, it receives the submitted text to be scored. We engage AI processors on terms that do not permit them to train on that text. We do not use submitted text to train or fine-tune our own models.

The particular recipients depend on the feature and plan used. For example, StealthGPT is used for a secondary pass on paid plans, while writing samples and style profiles are relevant only to personal writing-style matching. The Privacy Policy explains the purposes and retention periods in more detail.

4. Internal-only processing and infrastructure

For completeness, the following systems support restricted internal functions or infrastructure. They are not additional customer-facing AI recipients and receive no end-user text.

5. International transfers

Processing by the providers above is principally in the United States. This means personal data originating elsewhere may be transferred to a country whose data-protection law is not considered equivalent to the law where the individual lives.

For restricted transfers from the European Economic Area, we rely on the European Commission’s Standard Contractual Clauses (SCCs) where an adequacy decision or another valid transfer mechanism does not apply. For restricted transfers from the United Kingdom, we use the SCCs together with the UK International Data Transfer Addendum. Swiss transfers use the SCCs as adapted for Swiss law.

We supplement those contractual measures with a transfer risk assessment and technical and organisational measures appropriate to the transfer, including encryption in transit, access controls and least-privilege scoping, authenticated and caller-scoped endpoints, secrets management, request validation, rate limits, and tamper-evident audit records. No safeguard can eliminate every transfer risk.

6. How we choose and review providers

Before engaging a provider to process personal data, we assess the service it supplies, the data it needs, its security posture, processing locations and data-protection terms. We seek written processing terms appropriate to the role, including confidentiality, security, deletion or return, incident assistance, onward-processing and transfer provisions where applicable.

We limit each provider to the categories of data needed for its function, restrict production and administrative access, and review the arrangement when the service, risk, terms or processing materially changes. Due diligence reduces risk but is not a guarantee that a provider will never experience an incident.

7. Change notice

Notice before a new subprocessor starts

We will publish an update to this page before a new subprocessor starts processing customer personal data. Business and enterprise customers will receive advance notice where and within the period required by their Data Processing Agreement.

A business or enterprise customer may object to a new subprocessor on reasonable data-protection grounds using the procedure and deadline in the Data Processing Agreement, by writing to jakemorris@humanizes.com. We will review the concern in good faith and follow the options set out in the DPA; an objection does not necessarily require us to withdraw a provider.

To subscribe to subprocessor changes, contact jakemorris@humanizes.com from the address at which you want to receive notices and ask to be added to the subprocessor-change list.

8. Version history

The effective date at the top of this page is the date of the current provider list. The changelog records published versions so customers can identify when the list changed.

9. Contact

Questions about a provider, transfer safeguard or change notice can be sent to jakemorris@humanizes.com. The operator’s website is https://humanizes.com.