Sub-processors
Last updated: [YYYY-MM-DD]
| Vendor | Purpose | Region | Data | Transfer Mechanism | Notes |
|---|---|---|---|---|---|
| Vultr | IaaS compute/networking | Primary Frankfurt, DE; may use other Vultr regions | transcripts (at rest), logs, metadata | EEA hosting; if moved cross-border: SCCs | Encrypted disks; no E2EE |
| Stripe | Payments, invoicing, tax | US/EU | billing PII, payment tokens | SCCs + Stripe safeguards | PCI DSS Level 1 |
| Google Analytics (GA4) | Web analytics | Global | cookie/device IDs, events | SCCs + IP masking | Consent-based |
| Umami | Web analytics | Self-hosted in DE *(or note cloud region)* | page events, minimal IDs | N/A if self-hosted in EEA | Prefer cookieless |
| Email provider [TBD] | Transactional email | [Region] | name, email, notices | SCCs if outside EEA | e.g., Postmark/SES/SendGrid |
| Error monitoring [TBD] | Error tracking (optional) | [Region] | stack traces, metadata | SCCs if outside EEA | e.g., Sentry/Rollbar |
Change procedure
We will post updates here ≥14 days before adding/replacing a sub-processor (except urgent replacements for security/legal reasons, where we'll notify as soon as practicable). You may object on reasonable grounds; if unresolved, you may terminate affected services.
Contact
For questions about our sub-processors, please contact us at: info@vexa.ai