Sub-processors
Last updated:
AM8 engages the sub-processors below to provide its services. The Legal basiscolumn states, per sub-processor, which Data Processing Agreement (GDPR Article 28) governs it, and where no agreement is in force it says so rather than rounding up. An agreement can be absent for more than one reason: it may be awaiting a signature, or it may exist and not apply to us on our current plan. The column names which. Every instrument is recorded internally with its operative clause and a hash of the text it was read from. We notify customers by email at least 30 days in advance before adding or changing any sub-processor, so you can object before the change takes effect. Removing a sub-processor takes effect as soon as we can do it, because there is nothing there to object to.
| Sub-processor | Purpose | Data region | Legal basis |
|---|---|---|---|
| Anthropic | AI processing (Claude API)API data is not used for training. | United States | DPA + Standard Contractual Clauses |
| Mistral AI | Independent cross-check of AI-generated compliance documents (checks only, never chat or customer conversations; flags discrepancies for human review, cannot edit)French processor (Mistral AI, Paris). Receives only generated document content plus system-profile facts, solely to check the document against them. API data is not used for training. | EU (France, EU-resident inference) | Data Processing Addendum (incorporated by reference) |
| Vercel | Frontend hosting, global CDN & cookieless page analytics (loaded only with your consent) | EU / United States | No data processing addendum in force: it applies only on Enterprise and Pro plans |
| Railway | Backend application hosting (API & background workers)Executed on 19 August 2026 and signed by both parties. Railway’s DPA becomes binding on Railway’s signature rather than on our submission, and that signature is in place. | EU (Amsterdam) | Data Processing Addendum + Standard Contractual Clauses, executed 19 August 2026 |
| Supabase | Database, authentication & storage | EU (Frankfurt) | Data Processing Agreement |
| Stripe | Payment processing & billing | EU / United States | Data Processing Agreement |
| Resend | Transactional email delivery | United States | Data Processing Agreement |
| Sentry | Error monitoring (PII-scrubbed) | EU (Germany, EU data residency) | Data Processing Agreement |
Questions about our sub-processors or data processing? Contact our privacy team at privacy@am8-ai-governance.tech.