Sub-processors
Last updated:
AM8 engages the sub-processors below to provide its services. The Legal basiscolumn states, per sub-processor, which Data Processing Agreement (GDPR Article 28) governs it, and where one is still pending execution it says so rather than rounding up. Every instrument is recorded internally with its operative clause and a hash of the text it was read from. We notify customers by email at least 15 days in advance before adding or changing any sub-processor, so you can object before the change takes effect.
| Sub-processor | Purpose | Data region | Legal basis |
|---|---|---|---|
| Anthropic | AI processing (Claude API)API data is not used for training. | United States | DPA + Standard Contractual Clauses |
| Mistral AI | Independent cross-check of AI-generated compliance documents (checks only, never chat or customer conversations; flags discrepancies for human review, cannot edit)French processor (Mistral AI, Paris). Receives only generated document content plus system-profile facts, solely to check the document against them. API data is not used for training. | EU (France, EU-resident inference) | Data Processing Addendum (incorporated by reference) |
| Vercel | Frontend hosting, global CDN & cookieless page analytics (loaded only with your consent) | EU / United States | DPA + Standard Contractual Clauses |
| Railway | Backend application hosting (API & background workers)Submitted for counter-signature; not yet in force. Railway’s DPA becomes binding on Railway’s signature, not on our submission, so we report it as pending. Execution is a launch blocker: no customer tenant is onboarded onto this infrastructure until it completes. | EU (Amsterdam) | DPA pending execution |
| Supabase | Database, authentication & storage | EU (Frankfurt) | Data Processing Agreement |
| Stripe | Payment processing & billing | EU / United States | Data Processing Agreement |
| Resend | Transactional email delivery | United States | Data Processing Agreement |
| Sentry | Error monitoring (PII-scrubbed) | EU (Germany, EU data residency) | Data Processing Agreement |
Questions about our sub-processors or data processing? Contact our privacy team at privacy@am8-ai-governance.tech.