Subprocessors & Data Flow

Last updated: 2026-07-28

When you submit a paper for verification, it transits the following third-party services. This page lists every provider, what they process, and their data retention commitments.

Solonic's promise: Your submission is deleted from our systems after your report is delivered. This page documents what happens during processing — specifically, which third-party AI providers your paper transits and under what terms.

AI Model Providers

Your paper is sent to up to 12 model families for cross-review. Each call transits that provider's API. All calls use the standard API with no training-data opt-in.

ProviderModel FamilyJurisdictionAPI Data RetentionTraining Opt-Out
OpenAIGPT-4oUS30 days (abuse monitoring), then deletedAPI inputs not used for training (default)
AnthropicClaudeUS30 days (safety), then deletedAPI inputs not used for training (default)
Google / DeepMindGemmaUSPer Google Cloud termsAPI inputs not used for training
DeepSeekDeepSeek R1, V4ChinaPer DeepSeek API termsNot explicitly stated — review before submitting sensitive material
Meta (via OpenRouter)Llama 4 MaverickUS (OpenRouter)Per OpenRouter data policyOpen-weight model, no provider training
Mistral AIMistral MediumEU (France)30 days, then deletedAPI inputs not used for training
CohereCommand AUS/CanadaPer Cohere API termsAPI inputs not used for training (default)
xAIGrokUSPer xAI API termsReview terms before submitting sensitive material
Moonshot AI (Kimi)Kimi K2.6ChinaPer Moonshot API termsNot explicitly stated — review before submitting sensitive material
Zhipu AI (GLM)GLM 5.1ChinaPer Zhipu API termsNot explicitly stated — review before submitting sensitive material
AI21 LabsJambaIsrael/USPer AI21 API termsAPI inputs not used for training (default)
NVIDIA (NIM)DeepSeek V4 NIMUSPer NVIDIA NIM termsNot used for training

Important: Three providers (DeepSeek, Moonshot/Kimi, Zhipu/GLM) are based in China. Their API data retention and training-exclusion policies may differ from US/EU providers. If your submission contains privileged, classified, or export-controlled material, consult your compliance team before submitting. Solonic does not warrant third-party providers' compliance with any specific regulatory framework.

Infrastructure Providers

ProviderPurposeData ProcessedJurisdiction
StripePayment processingPayment info only — never sees your paperUS
CloudflareCDN, DDoS protection, DNSRequest metadata (IP, headers) — does not inspect paper contentUS
OpenRouterAPI routing for some model familiesPaper content transits to target modelUS

What we don't do

For regulated industries

If you need a formal Data Processing Agreement (DPA), mutual NDA, or specific compliance documentation (GxP, HIPAA, SOC 2), contact us at [email protected] before submitting. Enterprise engagements ($25K+) include custom data-handling agreements.

© 2026 Solonic — Verification for decisions that matter.