Sub-processors
Last updated:
AM8 engages the sub-processors below to provide its services. The Legal basiscolumn states, per sub-processor, which Data Processing Agreement (GDPR Article 28) governs it, and where no agreement is in force it says so rather than rounding up. We notify customers by email at least 30 days in advance before adding or changing any sub-processor, so you can object before the change takes effect.
| Sub-processor | Purpose | Data region | Legal basis |
|---|---|---|---|
| Anthropic | AI processing (Claude API)API data is not used for training. | US (Standard Contractual Clauses) | Data Processing Addendum with SCCs, in force by incorporation |
| Mistral AI | Independent cross-check of AI-generated compliance documents (checks only, never chat or customer conversations; flags discrepancies for human review, cannot edit)French processor (Mistral AI, Paris). Receives only generated document content plus system-profile facts, solely to check the document against them. API data is not used for training. | EU | Data Processing Addendum, in force by incorporation |
| Vercel | Frontend hosting, global CDN & cookieless page analytics (loaded only with your consent) | EU / US | Data Processing Addendum published, not yet in force for our account |
| Railway | Backend application hosting (API & background workers)Executed on 19 August 2026 and signed by both parties. Railway’s DPA becomes binding on Railway’s signature rather than on our submission, and that signature is in place. | EU (Amsterdam) | Data Processing Addendum + Standard Contractual Clauses, executed 19 August 2026 |
| Supabase | Database, authentication & storage | EU (Frankfurt) | Data Processing Addendum, in force by incorporation |
| Stripe | Payment processing & billing | EU (Ireland) | Data Processing Addendum, in force by incorporation |
| Resend | Transactional email delivery | US (Standard Contractual Clauses) | Data Processing Addendum, in force by incorporation |
| Sentry | Error monitoring (PII-scrubbed) | US entity, EU data region | Data Processing Addendum v5.1.0, in force on electronic opt-in |
Questions about our sub-processors or data processing? Contact our privacy team at privacy@am8-ai-governance.tech.