| Google (Gemini / Vertex AI) | LLM — moderation, extraction, analysis, transcription of recorded answers; proposed Search grounding remains default-OFF | Survey Q&A, respondent answers and metadata; proposed bounded terms only after counsel/provider approval. Recorded voice/video answers to voice-only or video-only questions are transcribed transiently. | United States |
| OpenRouterLLM gateway routing to DeepSeek, Kimi / Moonshot, OpenAI, and Perplexity | LLM gateway / routing | Answer text, question context, web-research prompts | United States |
| OpenAIEngaged via OpenRouter routing and directly, as the web-search fallback of the survey-design research tool (direct-account data-processing terms pending verification) | LLM — generation / grounded web-search fallback | Answer text, question context (via OpenRouter); researcher research queries (direct fallback — no respondent answers on that path) | United States |
| PerplexityUsed directly and via OpenRouter for Survey Designer research; may process extraction/data-cleaning inputs during migration or rollback (data-processing / no-training terms pending verification). This disclosure remains until a separately reviewed, artifact-bound post-backend contraction updates every canonical mirror. | LLM — grounded survey-design, extraction-planning, and data-cleaning terminology research | Researcher research queries; answer-derived terms (brands, abbreviations, slang) with survey context may be sent via OpenRouter during migration or rollback | United States |
| Anthropic (Claude) | LLM — analysis / auditing | Survey / analysis data | United States |
| DeepgramOptional — engaged when voice dictation is used, on the respondent survey and in the researcher workspace | Speech-to-text (voice dictation; live captions and the pre-recording device check for voice-only / video-only questions) | Respondent and researcher voice audio (streamed transiently for transcription; Deepgram stores no audio). Recordings for voice-only or video-only survey questions are stored by InsightsHero in Supabase Storage, not by Deepgram. | United States |
| ElevenLabsOptional — engaged only when respondent voice features are enabled (DPA & no-training terms pending) | Conversational voice AI / text-to-speech | Respondent voice audio and conversation text (questions + spoken answers; may contain PII) | United States |
| Langfuse | LLM observability | Traces including model inputs / outputs (may contain PII) | US / EU (configurable) |
| Sentry | Application error tracking | Error events, stack traces, request context (may incidentally include PII) | United States |
| Better StackObservability — logs, distributed tracing, uptime monitoring & status page (rolling out; PII redacted before egress) | Log aggregation / tracing / uptime monitoring | Application logs & traces — operational metadata only (respondent free-text and PII redacted before egress) | EU (default data residency) |
| Supabase | Database / Auth / Storage | All PII (disk-encrypted at rest) | AWS us-east-1 |
| Railway | Hosting / infrastructure / logs | Data in transit and memory, application logs | United States |
| ResendThe controller-authorized NPS invitation pilot is source-dark and unapplied; no roster has been imported or sent | Transactional email (demo requests, notifications, alerts, and separately approved survey invitations) | Recipient email, sender/reply-to, fixed message content; no survey answers or analysis attributes | United States |
| PostHogInteraction replays are masked — all typed input and on-screen text; images and other media are blocked; 30-day recording retention | Product analytics + masked interaction replay (debugging / service improvement) | Researcher usage events; respondent interaction telemetry (pseudonymous — no answer text) | United States (us.posthog.com) — Data Privacy Framework certified |
| Meta Platforms (Conversions API)Prospective and not production-approved; listing does not establish a provider role, contract, transfer mechanism, or activation | Proposed qualified paid-recruitment conversion measurement and optimization | Proposed payload: Meta click identifier, browser user agent, event URL/time, and pseudonymous event ID; no survey answers or contact data. The absence of IP address is specific to this dormant server-side design — see the browser Pixel row | United States / global (role and transfer review pending) |
| Meta Platforms (browser Pixel)Conditional — active only on surveys recruited via Meta ads where conversion tracking is enabled for that survey; those surveys disclose it on their welcome card. Off by default; role and transfer review pending | Ad conversion measurement for paid recruitment (page view + a completion event) | Meta click/cookie identifiers, browser user agent and IP address (inherent to any browser request), page URL, and a pseudonymous completion event ID; no survey answers, contact data, or respondent identity | United States / global |
| Cloudflare TurnstileOptional — per-survey, only when bot protection is enabled | Bot / CAPTCHA protection | Token + IP address | Global edge |
| Google Maps Platform (Maps + Places)Optional — active only when the Maps API key is configured; otherwise the map question uses an OpenStreetMap-based widget (see note below the table). Data-processing terms pending verification | Interactive map and place search for the map-pin question type | Respondent IP address and user agent (browser-direct), map viewport, and place-name searches; the pinned coordinates themselves are stored only in our own database | United States / global |
| ipwho.isOptional — passive IP-geolocation. Off by default; enabled or disabled by server configuration. No DPA (free keyless API); a local-lookup replacement is planned | Passive IP-geolocation (approximate city / region / country) | Respondent IP address — sent transiently in-request while the feature is enabled; the IP is not stored (only the derived city / region / country is kept) | Global (keyless free API) |
| Google Workspace | Internal email / documents (corporate) | Corporate data | United States |