Approved Vendor List
This is the authoritative list of AI vendors approved for processing Sunrise information. Every entry specifies the data class(es) the vendor is approved for, the contractual data posture (no-training vs. consumer), and the Sunrise procurement contact.
How to read this list. A vendor on this list is approved only at the data tier shown. A vendor approved for Tier 2 internal data is not automatically approved for Tier 4 named investor data. If your use case doesn't match a row exactly, ask in
#ai-at-sunrise before pasting.Approved — full commercial posture (Tier 0–4 eligible, subject to §5 tier rules)
| Vendor / Product | Data tier ceiling | No-training? | Sunrise procurement | Notes |
|---|---|---|---|---|
| Anthropic Claude Team Web app · API · MCP |
Tier 4 (with sanctioned-workflow controls per §4.4) | ✅ No-training by default (commercial) | Carlos Terrazas · subscription managed under Sunrise org | Primary AI tool for Sunrise. Personal Claude Pro is not equivalent — see §5.2. |
| Anthropic Claude Enterprise Enterprise SSO + admin controls |
Tier 4 (with sanctioned-workflow controls) | ✅ No-training by default | Carlos Terrazas · upgrade path from Team for IT/Finance leadership | Recommended for any user handling Tier 4 data routinely. |
Approved — limited posture (Tier 0–2 only, with conditions)
| Vendor / Product | Data tier ceiling | No-training? | Sunrise procurement | Notes |
|---|---|---|---|---|
| Sunny AI (internal) | Tier 4 (system pipeline only — humans do not paste named data) | ✅ Sunrise-controlled infrastructure | Carlos Terrazas | Governed by AUP §6. Internal-only by current design. |
| Google Workspace AI Gemini in Gmail, Docs, Sheets, Drive (incl. "Help me write", smart-fill, summaries, side-panel chat) |
Tier 1–2 (internal productivity only) | ✅ Workspace data-protection terms apply (no training on customer data) | Carlos Terrazas · Sunrise Google Workspace admin | Contract-included with our Workspace seats — no separate procurement. OK: draft emails, summarize threads/docs, format tables, brainstorm. NOT OK: Tier 3 financials, Tier 4 resident PII / investor data — switch to Claude Teams for those. Approved 2026-05-21. |
Pending evaluation (not yet approved)
| Vendor / Product | Use case under review | Decision target | Owner |
|---|---|---|---|
| HubSpot Breeze (embedded CRM AI) | Investor-relations communication assistance (Tier 4 sensitive) | Q2 review pending | Carlos + Ariana Klugiewicz |
| OpenAI ChatGPT Team / Enterprise | Alternate / backup for Tier 2–3 use | Not active evaluation | Carlos |
Pending vendors are not approved for any Sunrise data tier until evaluation completes and they appear on the approved list above. Do not use pending vendors on Sunrise data in the interim.
Explicitly prohibited
The following are not approved for any Sunrise data and require an AUP §16 update before any use:
- Free-tier consumer AI (ChatGPT free, Gemini free, public Claude) for Tier 2+ data — per AUP §5
- RealPage / YieldStar and any algorithmic competitor-pricing tool — per AUP §8.1
- SafeRent and any automated tenant-screening tool used without individualized human review — per AUP §8.1
- Auto-join meeting AI bots from any vendor not listed above as approved — per AUP §10.1 / §4.5
- Browser-extension AI reading the active page on a device handling Tier 2+ Sunrise data unless listed above — per AUP §4.5
Vendor evaluation process
To request a new vendor be evaluated for inclusion:
- Document the proposed use case, data tier, and business need.
- Submit to Carlos via
#ai-at-sunriseor direct email. - Carlos reviews vendor terms (data-training posture, DPA availability, security posture, enterprise SSO support, audit-log support).
- If approved, vendor is added to this list with its tier ceiling and conditions. If rejected, decision is documented with rationale.
- Quarterly review per AUP §16.
Vendor T&C change triggers
Any of the following triggers an out-of-cycle review per AUP §16:
- Vendor announces changes to data-training, retention, or sharing defaults.
- Vendor experiences a security incident affecting customer data.
- Vendor adds a new integration / connector / feature (browser extension, plugin, persistent memory, embedded AI feature) that materially changes the data-handling model.
- Vendor changes ownership or jurisdiction in a way that affects data-handling commitments.
Last updated: 2026-05-21 (Google Workspace AI approved · Tier 1–2 limited) · Vendor list maintained by Carlos Terrazas · Next quarterly review: 2026-08-01