The Controller has authorized the Processor’s use of the following Sub-Processors on a continuous basis in order to host and provide the standard Platform Services. Each Sub-Processor is bound by data protection obligations consistent with the Data Processing Addendum (DPA), including applicable Standard Contractual Clauses (SCCs) or equivalent transfer mechanisms for Restricted Transfers.
| Sub-Processor | Category | Service & Purpose | Data Location & Transfer Safeguards |
|---|---|---|---|
| Amazon Web Services, Inc. (AWS)Contact & support → | Infrastructure | Cloud hosting and storage services supporting the standard Platform Services. | US-East-1 (Virginia) — primary; US-West-2 (Oregon) — secondary. |
| AI Model ProvidersSee active providers ↓ | AI Models | AI model capabilities made available through the Platform. Current active providers are listed in the table below. | Per-provider DPAs accepted, each incorporating SCCs for Restricted Transfers. |
| Vercel, Inc.Privacy policy → | Workflow Solutions | Front-end and user-interface hosting for Workflow Solutions. Engaged solely in connection with active Workflow Solutions SOWs. | DPA executed with Vercel; includes SCCs for Restricted Transfers. |
| Neon Tech, Inc.Privacy policy → | Workflow Solutions | Serverless Postgres data storage for Workflow Solutions. Engaged solely in connection with active Workflow Solutions SOWs. | DPA executed with Neon; includes SCCs for Restricted Transfers. |
The Processor engages the following AI model providers as Sub-Processors to make AI model capabilities available through the Platform. This list is maintained on a continuously updated basis.
| Provider | Models & Capabilities | Transfer Mechanism |
|---|---|---|
| Anthropic, PBCanthropic.com → | Claude and related AI model capabilities. | Anthropic’s DPA accepted; incorporates SCCs for Restricted Transfers. |
| Google LLCGDPR processor terms → | Gemini AI model capabilities. | Google’s DPA accepted; incorporates SCCs for Restricted Transfers. |
| OpenAI, LLCData Processing Addendum → | ChatGPT and related AI model capabilities. | OpenAI’s DPA accepted; incorporates SCCs for Restricted Transfers. |
The Processor will provide not less than thirty (30) days’ prior written notice before adding or substituting any AI Model Sub-Processor that will process Customer Data containing Personal Data.
