docs: add Groq to the subprocessor list and name it in the Ask AI disclosure - #4396
Draft
Bishibop wants to merge 2 commits into
Draft
docs: add Groq to the subprocessor list and name it in the Ask AI disclosure#4396Bishibop wants to merge 2 commits into
Bishibop wants to merge 2 commits into
Conversation
✅ Deploy Preview for replicated-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for replicated-docs-upgrade ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
replicated-ci
added
type::docs
Groq processes Ask AI requests for the Enterprise Portal: end-customer questions and the portal content that customer is entitled to see are sent to Groq's API for inference. The feature is live today, so the listing reflects current production data flow rather than a planned one. Matches the existing OpenAI and FireworksAI rows, which use the same purpose category. Also adds Groq to the ThirdPartyProducts Vale vocabulary, without which the new row fails the spelling check.
Restores what #4391 deliberately withheld while Groq was absent from the Infrastructure and Subprocessors page. Depends on #4396 adding the Groq row. Must not merge before it: naming a processor missing from the published list is the exact inconsistency #4391 avoided, and Vale.Spelling fails on Groq until #4396 adds the vocabulary entry.
Bishibop
force-pushed
the
nick/groq-subprocessor-listing
branch
from
August 20, 2026 22:51
a712258 to
9a5c4cc
Compare
Bishibop
changed the title
Bishibop
changed the base branch from
main
to
nick/ep-v2-portal-features-ask-ai-docs
August 20, 2026 22:51
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds Groq to the Infrastructure and Subprocessors list, and names Groq in the Ask AI privacy disclosure. Final piece of sc-139273.
Important
This needs a sign-off I cannot give, and that is the point of the PR.
The page's own preamble states: "Prior to engaging any third party, Replicated performs diligence to evaluate their privacy, security and confidentiality practices." Merging asserts that diligence happened for Groq. I have verified the data flow from source; I have not verified that the diligence was performed, and I have no way to.
The precedent commit on this page is explicit about the direction of causation — Andrew Storms, 2024, adding Postmark and Active Campaign: "Both vendors were previously approved, but mistakenly left out from the list." The list records approvals; it does not create them.
So the question is: has Groq been diligenced and approved as a subprocessor? If yes, this is the clerical follow-through. If no, it should stay closed.
The two halves are deliberately in one PR
The invariant worth protecting is: the disclosure names Groq if and only if Groq is on the published list. Splitting these into two PRs would make that depend on merge ordering — someone could publish a disclosure naming a processor absent from our own list, which is the exact inconsistency #4391 was written to avoid. One atomic change makes that structurally impossible.
Base is #4391's branch, since the Ask AI page does not exist on
mainyet. GitHub retargets this tomainautomatically when #4391 merges. Nothing here is urgent enough to want them separate — both halves wait on the same answer.Changes
policies-infrastructure-and-subprocessors.md— one row, plus aLast modifiedbump:enterprise-portal-v2-portal-features.mdx— three lines. Names Groq and theopenai/gpt-oss-120bmodel in place of "a third-party AI provider", and restores two links to Infrastructure and Subprocessors.No change to the substance of the disclosure. What data is transmitted was already documented in #4391 and is untouched. This adds only the identity.
accept.txt—Groqadded to the ThirdPartyProducts Vale vocabulary; without it both pages failVale.Spelling.What was verified, and how
Read from
replicatedhq/vandoorata56ae15d2, not from UI copy:ask_ai.go:513—POST https://api.groq.com/openai/v1/chat/completionsopenai/gpt-oss-120bask_ai.go:499historyLimit := 10,ask_ai.go:103, counting user and assistant messages together); and the portal content the asking customer is entitled to seeNot sent: customer identifiers, license fields, or entitlement values as data.
Note the model id reads as
openai/gpt-oss-120bbut the processor is Groq, not OpenAI —gpt-ossis an open-weights model served by Groq. Worth stating explicitly because OpenAI is already listed separately on this page and the two must not be conflated. This is also why #4391 withheld the model id along with the provider: naming the model alone would have pointed readers at the wrong processor.Why the disclosure shipped unnamed in the first place
Ask AI is live in production today and was shipping to customers with no documentation at all. Holding that page until a subprocessor listing landed would have kept a live data flow undocumented for an unbounded period, so #4391 shipped with the disclosure intact — what data leaves, and that it goes to a third-party AI provider — and deferred only the identity.
Whatever the answer to the sign-off question above, note that the underlying gap exists right now and is not created by this PR. This row documents an existing flow, not a planned one.
If this is rejected
Close it. #4391 is correct and complete without it — the page keeps saying "a third-party AI provider", which is true.
Unrelated, not touched
The subprocessor page carries three genuine typos in customer-facing policy text:
identifible(line 8),posess(line 10),calednar(line 40). Left alone so this stays a clean compliance decision. Happy to fix separately.