Sub-processors
Last updated: 2 May 2026
AM8 engages the sub-processors below to provide its services. A signed Data Processing Agreement (GDPR Article 28) is in place with each one before any customer data is processed. We notify customers by email at least 15 days in advance before adding or changing any sub-processor, so you can object before the change takes effect.
| Sub-processor | Purpose | Data region | Legal basis |
|---|---|---|---|
| Anthropic | AI processing (Claude API)Covered by a Zero Data Retention (ZDR) addendum — prompts and outputs are not retained for training. | United States | DPA + Standard Contractual Clauses |
| Vercel | Frontend hosting & global CDN | EU / United States | DPA + Standard Contractual Clauses |
| Supabase | Database, authentication & storage | EU (Frankfurt) | Data Processing Agreement |
| Stripe | Payment processing & billing | EU / United States | Data Processing Agreement |
| Resend | Transactional email delivery | United States | Data Processing Agreement |
| Sentry | Error monitoring (PII-scrubbed) | United States | Data Processing Agreement |
Questions about our sub-processors or data processing? Contact our DPO at dpo@am8-ai-governance.tech.