Render is adding Anthropic, TypeSafe AI and others to its Subprocessors

Render has updated its subprocessors list to include Anthropic, PBC and TypeSafe AI, Inc., both categorized under AI / Machine Learning, alongside its existing roster of infrastructure partners spanning cloud hosting, monitoring, and workflow orchestration. The move reflects Render's expanding use of AI tooling inside its platform as it builds out agent-focused products like Render Sandboxes.

This article covers what changed on Render's security and trust page, what each new entry means for data processing on the platform, how Render's compliance posture is structured, and what the subprocessor additions signal for developers building on Render. It is relevant to any team that uses Render and needs to track where their data flows for GDPR, HIPAA, or SOC 2 compliance purposes.

01Anthropic and TypeSafe AI join the subprocessor table

Render's security page now lists Anthropic, PBC and TypeSafe AI, Inc. as subprocessors under the AI / Machine Learning category, both based in the United States. The existing list already included Amazon Web Services and Google Cloud Platform for hosting, Cloudflare and ClickHouse Inc. for platform services, Grafana Labs (Raintank, Inc.) for monitoring and observability, and Temporal Technologies Inc. for workflow orchestration.

Adding two AI vendors to the list is a formal acknowledgment that AI and machine learning services now process data on behalf of Render's customers. Subprocessor lists carry legal weight under GDPR and similar frameworks — vendors must disclose entities that handle personal data, and customers are entitled to object or assess risk when new subprocessors are added.

02Render's compliance framework and what it covers

Render holds ISO 27001 certification, the global standard for establishing and maintaining information security management systems. It also carries a SOC 2 Type 2 report covering the trust services criteria for security, confidentiality, and availability, and maintains a GDPR Data Processing Agreement to protect the personal data and privacy of EU citizens for transactions within EU member states.

The platform additionally supports HIPAA-compliant workloads, allowing teams to build and scale healthcare applications on Render's infrastructure. Render is also certified under the EU-US Data Privacy Framework, including the UK extension and the Swiss-US Data Privacy Framework, covering cross-border data transfers from Europe and Switzerland to the United States.

03Render Sandboxes and the AI direction behind the update

Render announced Render Sandboxes alongside its security page refresh, describing it as "a computer for every agent." The product is positioned for AI agent workloads — isolated compute environments that agents can use to run tasks. The addition of Anthropic and TypeSafe AI as subprocessors aligns directly with that direction, suggesting Render is integrating or evaluating these AI services to power agent capabilities on the platform.

TypeSafe AI, Inc. is a less publicly prominent name than Anthropic, and its inclusion hints at Render using multiple AI providers rather than committing to a single model vendor. Anthropic, a US-based AI safety company, produces the Claude family of models widely used in developer-facing products.

04Security practices and vulnerability reporting on the platform

Render operates a Shared Responsibility Model that defines how security obligations are divided between Render and its customers. The company publishes guidance on responsible penetration testing and secrets management, with tooling at the application layer for securing credentials while Render handles core infrastructure safeguards.

Security researchers can submit vulnerability reports through Render's Vulnerability Disclosure Program on HackerOne. For abuse reports — covering violations of Render's Acceptable Use Policy such as hosting malicious software, sending unsolicited email, or phishing — the company accepts reports at abuse@render.com and commits to determining action as quickly as possible. Other security issues can be directed to security@render.com.

05What the subprocessor additions mean for existing customers

Any customer operating under GDPR or a similar data protection regime should review the updated subprocessor list and assess whether their data processing agreements need to be amended. Render's GDPR-DPA and Data Privacy Framework certification provide baseline protections, but customers may need to evaluate Anthropic and TypeSafe AI's own data handling practices if they process personal data through Render's AI-powered features.

Teams running HIPAA-regulated workloads should pay particular attention to whether any AI-processed data flows through these new subprocessors. Render has not published a detailed breakdown of which platform features route data to Anthropic or TypeSafe AI specifically, so customers with strict data residency or processing requirements may want to contact Render directly before enabling AI-integrated features.