Subprocessors

This page lists the service providers and subprocessors that support the Cortrova website operated by Trunnion AI, LLC, states how product-deployment subprocessors are confirmed, and describes our change-notice commitment. It is referenced from the Privacy Notice and the Security page.

Website subprocessors

• Render (Render Services, Inc.): static site hosting and content delivery, the Cortrova lead and privacy-request API, and the managed PostgreSQL database that stores form submissions. Receives submitted form data and request metadata.
• Cloudflare, Inc.: DNS, edge network, and caching in front of the hosting layer. Processes request metadata in transit.
• Google LLC (Google Workspace): delivery of contact and privacy-request notification email to our monitored inboxes. Receives the content of submitted requests.
• Trunnion lead registry (affiliated): private reporting and tenant-scoped review of submitted contact requests. Receives a reporting copy of contact-form fields after submission, independent of optional analytics consent.

Consent-gated optional providers

The Trunnion SDK may send identifier-free aggregate page-load counts containing date, hour, broad device class, and country code, with no page path or visitor/session ID, until rejected. Raw IP and user-agent values are reduced transiently and are not retained in aggregate storage. It sends detailed events only after analytics acceptance. Google Analytics 4 and Meta Pixel remain unconfigured. Browser measurement is separate from the submitted-contact reporting copy described above.

Product deployment subprocessors

A contracted Cortrova product deployment runs on the infrastructure and providers confirmed for that engagement. AI model routing options for the product include Anthropic and OpenAI; the model providers actually engaged for a deployment, the regions used, and the retention and training restrictions that bind them are identified in the written security schedule for that engagement before production use, consistent with the tenant-scoped training position in our AI Transparency Notice. Customers receive the current product subprocessor schedule with their agreement and change notice for it under the terms below.

Change notice

We update this page, with a new dated version, at least 30 days before a new subprocessor begins processing personal information for this website, except where an emergency replacement is required to maintain security or availability, in which case we update this page as soon as reasonably possible and explain the change. Customers and evaluating buyers may request direct email notification of subprocessor changes by writing to privacy@trunnion.ai.

Data processing agreement

A standing data processing agreement covering the website and, for contracted deployments, the product processing terms is available on request. Email legal@trunnion.ai with the subject "Cortrova DPA request" and we will provide the current DPA for review and execution.