← Trust Center

Sub-Processor List

This document inventories every third party that processes customer data on Primus's behalf via the PrimeTDAP platform — every "sub-processor" under common Data Processing Agreement terminology. The inventory supports the Sub-Processor disclosure obligations in customer Master Services Agreements and Data Processing Agreements.

Additions or material changes are notified to active customers at least 45 days in advance per our standard DPA. To subscribe to change notifications, email legal@primussoft.com.

Active sub-processors

Microsoft Corporation

Role	Cloud hosting, managed database, identity, secrets management, communications (Email + SMS for one-time-codes), storage, logs.
Region	United States — Azure East US 2
Data residency	United States
Use for AI training	No — per the Microsoft Online Services terms, Microsoft does not use customer data in Azure services to train AI models.
Audit posture	SOC 1 / SOC 2 / SOC 3, ISO 27001, ISO 27018, FedRAMP High, HIPAA BAA available.
Contract	Microsoft Online Subscription Agreement (Primus tenant); Microsoft Online Services Data Protection Addendum.

Anthropic, PBC

Role	AI inference (text-only) — analytical synthesis, structured rendering, and bounded chat features of the platform.
Region	United States — Anthropic's primary inference infrastructure
Data residency	United States
Use for training	No — Anthropic does not train AI models on API customer data per the Anthropic Commercial Terms of Service §7 and the Anthropic Usage Policy.
Anthropic-side retention	30 days for abuse monitoring, per Anthropic Commercial Terms; deleted thereafter unless required for legal compliance.
Audit posture	SOC 2 Type II. trust.anthropic.com.
Contract	Anthropic Commercial Terms of Service (Primus API account).

Detailed operational inventory — including the specific Azure services in use and the Claude model versions invoked — is part of the Security & Compliance documentation pack, available under NDA.

Sub-processor change procedure

Adding, removing, or materially changing a sub-processor requires:

1. Documented rationale by the engagement lead.
2. Notification to active customers at least 45 days in advance per the standard DPA.
3. Update of this inventory document.
4. Update of related public-facing policies (AI Disclosure, Privacy Policy) where user-visible.
5. Communication to active users where their data is materially affected.

Inactive or out-of-scope vendors

None at this time. Future productisation may introduce additional vendors (for example, payment processing or customer-relationship management). Each addition will follow the change procedure above.

Review cadence

This inventory is reviewed at least quarterly, and on any change in sub-processor relationships.

To subscribe to sub-processor change notifications, email legal@primussoft.com.