Document360 Subprocessors List (November 2026): Changes and History
Document360 names 14 subprocessors on its published list. Read from the vendor's own page and re-checked daily.
Document360 subprocessors (November 2026)
| # | Subprocessor | Purpose | Location |
|---|---|---|---|
| 1 | MongoDB | Used as our vector database | — |
| 2 | OpenAI | Provides AI capabilities, utilizing their advanced models | — |
| 3 | Azure | Our cloud provider ensures a scalable and reliable infrastructure | — |
| 4 | Stripe | Facilitates secure payment processing | — |
| 5 | Segment | Used for product analytics to enhance the user experience | — |
| 6 | Mixpanel | Enables advanced analytics | — |
| 7 | Cloudflare | To manage network traffic & firewall | — |
| 8 | Cloudflare Turnstile | Bot detection and prevention of automated abuse for application security. See the Cloudflare Turnstile Privacy Addendum for details. | — |
| 9 | Data Privacy | Customer data is processed only to deliver AI-assisted functionality within the platform. Data is handled in accordance with our Privacy Policy, contractual commitments, and applicable data protection laws. | — |
| 10 | Model Training | Customer content is not used by Document360 to train AI models. OpenAI processes data in accordance with contractual terms and applicable data protection obligations. | — |
| 11 | Data Security | AI-related data processing is subject to the same security and access controls that apply across the Document360 platform. We rely on OpenAI’s security controls and contractual commitments for model-level protections. | — |
| 12 | Model Security | Model security and infrastructure protections are managed by OpenAI. Document360 does not operate or modify AI models directly. | — |
| 13 | Model Accuracy | AI-generated outputs are intended to assist users and may require human review. Customers remain responsible for reviewing and validating AI-generated content before publication or use. | — |
| 14 | Data Hosting & Locality | AI processing locations are determined by OpenAI’s infrastructure and contractual commitments. Document360 does not independently control AI model hosting locations. | — |
Get an email when Document360 changes its subprocessors
ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.
AI and customer data at Document360
What Document360's own documents say, with the sentence each answer comes from.
- Trains AI models on customer data
-
No
“We do not use customer content submitted to AI Features to train or fine-tune our own AI models or those of our third-party AI providers.”
Privacy policy, document360.com ↗ - Sends customer data to AI model providers
-
Yes: OpenAI
“To provide AI Features, we share relevant data with third-party AI providers, currently including OpenAI, these providers process data solely to generate the requested output”
Privacy policy, document360.com ↗ - How to opt out
-
Account administrators may disable certain AI Features via account settings, except where a feature is integral to the Service.
“Account administrators may disable certain AI Features via account settings.”
Privacy policy, document360.com ↗ - How long AI features keep data
-
Data sent to AI sub-processors is kept only as long as needed to generate the output and generally not beyond 30 days, except for abuse, security or legal needs.
“Data sent to our AI sub-processors is retained only for as long as necessary to generate the requested output and, where supported by the provider's terms, is not retained beyond 30 days, except where required for abuse monitoring, security, or legal compliance purposes.”
Privacy policy, document360.com ↗
Certifications at Document360
What Document360's trust page lists, with the text each one comes from.
- ISO 27001
-
Active
“ISO 27001:2022”
Trust page, document360.com ↗
Documents we track for Document360
- Privacy policy
- checked November 3, 2026 changed October 6, 2026 document360.com ↗
- Subprocessor list
- checked November 3, 2026 document360.com ↗
- Terms of service
- checked November 3, 2026 document360.com ↗
- Trust page
- checked November 3, 2026 document360.com ↗
Change history
-
AI terms changed
The AI opt-out wording changed. The wording on how long AI features keep data changed.
-
Privacy policy changed
Document360 added a new "AI and Automated Processing" section (now Section 6) disclosing that AI Features (AI Chatbot, AI Writing Agent, Article Summarizer, etc.) send customer and end-user prompts, uploads and outputs to third-party AI sub-processors, currently including OpenAI, retained for up to 30 days; the policy states customer content is not used to train Document360's or providers' AI models, and a new "AI Interaction Data" category and automated decision-making/human-review rights were introduced. The effective date also moved from "1st August 2025" to "01/08/2026" (version v2.0), ...
Tracking since October 12, 2026. Every change links to the two versions of the document it came from. All vendors' changes →
Document360 subprocessors FAQ
- How many subprocessors does Document360 use?
- Document360 lists 14 subprocessors on its published list, including MongoDB, OpenAI, Azure, Stripe, and Segment and 9 more.
- Does Document360 use customer data to train AI models?
- According to its privacy policy, Document360 does not use customer data to train AI models: “We do not use customer content submitted to AI Features to train or fine-tune our own AI models or those of our third-party AI providers.”
- Which AI model providers does Document360 send customer data to?
- OpenAI is named in Document360's privacy policy: “All our AI features uses third party AI tools including services provided by OpenAI, LLC ("OpenAI") and your data will be sent to them to get responses via API.”
- Which security certifications does Document360 list?
- Document360's trust page lists ISO 27001.
- When was Document360's subprocessor list last checked?
- ClauseTrail last checked Document360's subprocessor list on November 3, 2026. Lists are re-checked daily.
- How do I find out when Document360 adds or removes a subprocessor?
- ClauseTrail monitors Document360's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.