Draft — pending legal review
Sub-Processor List
Last updated April 27, 2026
This page lists the third-party “sub-processors” RaiseAppraisal.com (Malama Funding LLC) uses to deliver the Service. Each sub-processor is contractually required to use your data only for the services they provide to us, and to maintain reasonable security practices.
Change notifications
We update this list when we add, remove, or change sub-processors. Subscribed Enterprise customers are notified by email at least 30 days before any new sub-processor is added.
1. Hosting, Infrastructure & Storage
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Vercel, Inc. | Application hosting, edge network, serverless functions | All Service data in transit | United States |
| Vercel Postgres (managed by Vercel; underlying provider may vary) | Primary database — accounts, subscriptions, analyses, audit logs | Account info, subscription state, analysis data, audit logs | United States |
| Vercel Blob | File storage — uploaded appraisal PDFs and generated documents | Uploaded PDFs, generated ROV documents | United States |
2. Payment Processing
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Stripe, Inc. | Subscription billing, payment processing, invoicing, refunds | Name, billing address, email, payment method (full card data goes only to Stripe), transaction history | United States |
| Stripe Tax (Stripe product) | Sales tax calculation and remittance | Billing address, transaction amounts | United States |
3. Artificial Intelligence
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Anthropic, PBC | Claude API — appraisal data extraction, ROV argument generation | Appraisal text content (which may contain borrower names, addresses, comparables) | United States |
| Google LLC | Gemini API — secondary AI processing | Appraisal text content | United States |
Note
Both Anthropic and Google do not train their models on data sent through their APIs. This is contractually required under their API terms of service.
4. Real Estate Data Providers
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| SFR Analytics (SFRA) | Property records, AVM data, comparables, rental data, ZIP-level market data | Property addresses, coordinates | United States |
| RapidAPI (data marketplace, used to access Redfin, Zillow, Realtor.com) | Property and comparable sale data | Property addresses, coordinates | United States |
| U.S. Department of Housing and Urban Development (HUD) | Fair Market Rent, county income limits | County / ZIP code | United States (government) |
| Google Maps Platform | Address geocoding (fallback when ZIP missing) | Property addresses | United States |
| OpenStreetMap (Nominatim) | Address autocomplete | Partial address strings | Netherlands (open-source service; we self-host or use public endpoint) |
5. Email & Communications
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Postmark (or Resend / SendGrid) | Transactional email delivery (subscription confirmations, dunning, marketing) | Email addresses, email content | United States |
6. Analytics & Marketing Attribution
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Google Analytics 4 (Google LLC) | Website usage analytics with IP anonymization | Anonymized IP, page views, user agent | United States |
| PostHog (or Mixpanel) | Product usage analytics | Anonymized usage events, user IDs | United States |
| Meta Conversions API (server-side, Limited Data Use mode) | Ad attribution for Meta-platform ads | Hashed email, conversion events (server-side, no browser cookies) | United States |
7. Customer Support
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| (Help-desk software) — TBD: Zendesk / Help Scout / Intercom / similar | Support ticket management, customer communications | Email, name, ticket content | United States |
What We Do Not Use
For transparency, here are common SaaS sub-processors we do not use:
- Cross-site advertising networks
- Behavioral retargeting services
- Data brokers
- Consumer credit reporting agencies
- Any sub-processor that would process or sell your data for purposes other than serving you
How We Manage Sub-Processors
For each sub-processor we engage, we:
- Conduct due diligence on their security practices, including reviewing their SOC 2 reports, ISO 27001 certifications, or equivalent
- Sign a Data Processing Agreement (DPA) that requires them to process your data only for the services they provide and to maintain reasonable security
- Periodically review their continued suitability and notify you of material changes
- Maintain a record of what categories of personal information each sub-processor receives
Notification of Changes
For non-Enterprise subscribers, we'll update this page when sub-processors change.
For Enterprise customers under a Master Services Agreement (MSA) and Data Processing Agreement (DPA), we provide 30 days' email notice before adding any new sub-processor that will process customer data, allowing time for review and objection.
Subscribe to Change Notifications
Want to be notified by email when this list changes? Email privacy@raiseappraisal.com with subject line “Sub-Processor Change Notifications” to be added.