Sub-processors
Every third party that can process data on OtterSR’s behalf, what each one receives, and the categories we deliberately do not use at all.
Last updated
1.Current sub-processors
This list was written from the running code and the infrastructure definitions, not from a vendor spreadsheet. Everything that can receive your data is here.
| Sub-processor | What it does | What it receives | Location |
|---|---|---|---|
| OpenAI — API | Runs the large language models behind every engine tier, and turns passages of your documents into search vectors (embeddings), so a writing command can find what the papers say. Every model call in OtterSR goes to OpenAI; there is no other inference path. Model calls are sent with storage turned off. | The prompt for each call — titles, abstracts, the extracted text of a document for full-text work, and the passages and extracted values a writing command uses — plus the model’s response; and passages of the documents you upload and of your manuscripts, for the search index. | US |
| Amazon Web Services — EC2 and EBS | Runs the application, its database and its logs, on encrypted volumes. | Everything in §2 of the Privacy Policy: account, profile, references, answers, extracted values, manuscripts, usage and charges. | US (us-east-2, Ohio) |
| Amazon Web Services — S3 | Stores uploaded PDFs, their extracted text, and the figures and tables the Write stage makes. | The documents you upload and the files made from them. | US (us-east-2, Ohio) |
| Amazon Web Services — Amplify Hosting | Serves the web app, and passes your requests to the application. | Everything you send and receive passes through it encrypted, along with IP addresses and request details. It keeps no review content. | US (us-east-2, Ohio), entering through the nearest AWS edge location |
| Amazon Web Services — Cognito | Signs you in with an email address and password, and records sign-in events. Emails sign-up confirmation codes and password-reset codes, for now from AWS’s sender, no-reply@verificationemail.com. | Your email address, name and password. AWS keeps the password as a salted hash, which OtterSR cannot read. | US (us-east-2, Ohio) |
| Amazon Web Services — SES | Sends our service email: invitations and notices that a job has finished. | The recipient’s email address, their name where the email uses it, and the message. | US (us-east-2, Ohio) |
| Amazon Web Services — Secrets Manager | Holds application secrets. | No customer data. | US (us-east-2, Ohio) |
| Stripe | Takes payments and issues receipts. | Your name and email, the card you enter (directly — it never reaches us) and the amount and description of each payment, which names the review. | US and Canada (Stripe Payments Canada, Ltd.) |
| Microsoft 365 | Our mailbox. It handles what you send to support@ottersr.com. | Your address and whatever you write. | Microsoft's data centres for our tenant |
2.Identity providers
If you sign in with Google or Microsoft, they authenticate you. They are not sub-processors of your review content — nothing you upload ever reaches them — but they do learn that you signed in to OtterSR, and they give us your name, email address and a stable identifier. We request only the openid, email and profile scopes; we never ask for access to your mail, files or calendar.
3.Literature databases you search
When you run a search, your query is sent to the database you chose. These are not sub-processors — they process nothing on our behalf — but data does leave, so they are listed here rather than hidden.
- PubMed / NCBI E-utilities
- Europe PMC
- Crossref
- OpenAlex
- ClinicalTrials.gov
- Preprint servers
Each receives the search terms you typed and an identifying contact address for OtterSR, as their usage policies require. None receives your account details or anything else from your review.
4.Not a third party
PDF structure extraction uses GROBID, which runs as a container inside our own private network. Document text is not sent to any external parsing service.
5.Deliberately absent
Several categories of vendor that a service like this usually carries are not here, and their absence is a design decision rather than an oversight:
- No product analytics. No PostHog, Google Analytics, Segment, Mixpanel, Amplitude or similar, in the marketing site or the application.
- No advertising or marketing-automation platform.
- No session recording, heatmaps or support-chat widget.
- No third-party CDN for fonts or scripts. Web fonts are served from our own origin.
- No model provider other than OpenAI. OpenAI computes the search embeddings too. Your text is not sent to Amazon Bedrock, Google, Anthropic or any other model provider.
6.Changes to this list
We will publish a change here and notify account owners at least 30 days before a new sub-processor starts processing customer data. Objection rights are in §7 of the Data Processing Addendum. To be told when this page changes, write to support@ottersr.com.