Processors and subprocessors register — SiCusto AI Customer Support

1How to read this register

Role — “Processing” means a party receiving personal data to perform a task (AI response generation · Email delivery · Authentication); “Storage” means storage and execution infrastructure.
Training use and provider retention are separate columns — all three AI providers retain data for a period to monitor abuse, even though they do not use it for training. We therefore do not promise “zero data retention” (Annex 3 to the Data Processing Agreement).
Provider policies change. The source links and verification dates in each row will be checked again at the time of contracting.

2Register

Provider policies and applicable terms will be checked again at the time of contracting.

Processor	provider	Role	Data processed	Country	Outside Korea	Training use	Provider retention (period · purpose)	Zero data retention	Source
Anthropic (Claude API) Anthropic, PBC 【Contracting entity requires verification — the legal entity contracting with the console account】	`anthropic`	Processing (API calls to generate responses)	End customer messages (masked) · Client knowledge documents · Support instructions	United States 【Processing region requires verification — provider infrastructure policy】	Outside Korea	Business API inputs and outputs are not used to train models (commercial terms)	API inputs and outputs are deleted from the provider backend within 30 days of receipt or generation · If a usage policy violation is found: inputs and outputs up to 2 years · Classification scores up to 7 years · Exceptions for legally required retention Purpose: abuse monitoring (usage policy enforcement) · Legal compliance	No zero data retention (ZDR) agreement — available only under a separate agreement 【Whether an agreement has been signed requires verification】	www.anthropic.com/legal/commercial-terms privacy.claude.com/en/articles/7996866-how-long-
Google Gemini API (Gemini Developer API) Google LLC 【Contracting entity requires verification】	`google`	Processing (API calls to generate responses · Failover during outages)	End customer messages (masked) · Client knowledge documents · Support instructions	Google infrastructure in the United States and other countries 【Processing region requires verification】	Outside Korea	Prompts and responses in billing-enabled projects (paid services) are not used for product improvement or development 【Verify that billing is enabled for the API key’s Google Cloud project — terms differ for the free tier】	Paid-service prompts and responses are logged for 55 days for abuse detection and legal disclosure obligations (not used for training) · Project logging is separate (55 days by default · Can be shortened to 7/14/28 days) Purpose: abuse detection · Legally required disclosure	An exemption from abuse-monitoring logging (zero data retention) for the Gemini Developer API has not been verified in official documentation 【Verification required】	ai.google.dev/gemini-api/docs/logs-policy
OpenAI API 【Contracting entity requires verification — the counterparty for the OpenAI organization account】	`openai`	Processing (API calls to generate responses · Failover during outages)	End customer messages (masked) · Client knowledge documents · Support instructions	United States 【Processing region requires verification】	Outside Korea	Data sent through the API is not used to train or improve models without explicit consent (opt-in)	Abuse-monitoring logs retained for up to 30 days (exceptions for legal requirements and harm prevention) · The storage option (store) is not enabled for Chat Completions 【Recheck at the time of contracting】 Purpose: abuse monitoring · Legal compliance	Zero data retention (ZDR) and modified abuse monitoring require prior OpenAI approval — no application made 【Verification required】	developers.openai.com/api/docs/guides/your-data
Google Cloud — Firebase / Cloud Firestore · Cloud Functions · Hosting Google LLC 【Contracting entity requires verification — based on the Google Cloud billing account】	`gcp`	Storage (data storage · Server execution)	Support sessions and messages (masked) · Human handoff requests (original contact details) · Knowledge documents · Usage ledger · Audit logs · Implementation inquiries	Republic of Korea (Seoul region asia-northeast3)	Within Korea	Not applicable (storage · execution)	Production originals follow the privacy policy’s retention table · Backups: point-in-time recovery (PITR) + daily backups retained for 7 days 【Completion of backup configuration requires verification】 Purpose: disaster recovery	Not applicable	— cloud.google.com/firestore/docs/backups
Firebase Authentication (admin page accounts) Google LLC	`firebase-auth`	Processing (authentication of client contact accounts)	Client contact email · Password hash · Login time — no end customer data	【Verification required — Firebase Authentication does not offer region selection】	【Verify】	Not applicable	Terminated memberships are retained with a termination flag · Accounts are deleted at contract termination (tenant deletion); for accounts also used by consumer apps, only the membership is removed Purpose: authentication	Not applicable	— firebase.google.com/support/privacy
Gmail SMTP (outgoing email) Google LLC 【Representative to verify — Google Workspace account or regular Gmail account】	`smtp`	Processing (email delivery)	Human handoff emails (end customer contact details · Inquiry · Recent conversation) · Invitation, alert and report emails	Google mail infrastructure in the United States and other countries 【Verification required】	Outside Korea	【Verification required — terms vary by account type】	Sent-mail copies follow the sending account’s policy · Delivered emails remain in the recipient’s (client’s) mailbox — subject to deletion requests Purpose: email delivery records	Not applicable	—

4When changes occur

Advance notice to the client before changes apply (Article 5(3) of the Data Processing Agreement) → Guidance on updating the paragraph inserted in the client’s privacy policy (D-3).