Subprocessors
Data processors (Art. 28 GDPR)
This English translation is provided for convenience only. The Spanish version is the legally binding text.
This document is for information purposes only. It does not constitute legal advice. For its interpretation as applied to your specific situation, consult a professional.
Sub-processors
Alethexis relies on the following sub-processors to provide the service. All of them process data on behalf of the customer (the controller) under a data processing agreement (Art. 28 GDPR).
| Provider | Purpose | Data processed | Location | Safeguard mechanism |
|---|---|---|---|---|
| Supabase | Database, storage, authentication and functions | All product data | EU — Frankfurt (eu-central-1) | Supabase DPA + SCCs (US entity) |
| Vercel | Application hosting and Edge network | HTTP logs, request metadata | United States (primary processing) + global edge | EU-US DPF + SCCs |
| Cloudflare | DNS proxy, CDN, WAF and Turnstile (captcha) | Visitor IP addresses and browser signals | United States (proxy over all traffic) | EU-US DPF + SCCs |
| Stripe Payments Europe | Payment processing | Payment data | United States (+ India) | SCCs + EU-US DPF |
| Resend | Transactional email delivery | Recipient email address and message content | United States (delivery via SES eu-west-1) | SCCs + EU-US DPF |
| Google Workspace | Inbound email and customer communication | Email content and sender data | United States / EU (Google Ireland) | SCCs + EU-US DPF |
| Holded | Statutory invoicing | Customer tax data (tax ID, company name, amounts) | Spain (entity); US sub-processors (GCP, MongoDB Atlas, Salesforce) | Holded DPA + SCCs (sub-processors) |
| Sentry | Error monitoring | Error traces (with PII scrubbing), metadata | EU — Frankfurt | Sentry DPA (EU configuration) |
Internal providers (no access to customer data)
The following providers form part of our development and internal operations environment. They do not process customer production data. They are listed for transparency.
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| GitHub | Source code repository | Source code. No customer data | United States (standard contractual clauses) |
| Anthropic | Claude models used in development | Development prompts and code only. No customer production data | United States / EU depending on endpoint |
International transfers
Product data is hosted in the European Union (Frankfurt). Some processors supporting the service process personal data outside the EEA (United States), covered by transfer safeguards in accordance with Chapter V of the GDPR: standard contractual clauses (Art. 46(2)) and, where applicable, the EU-US Data Privacy Framework. The location and mechanism of each processor are detailed in the table above.
Notification of changes. Any addition of a new sub-processor is notified to customers 30 days in advance by email and by notice in the product. Customers may object in accordance with the data processing agreement.