Subprocessors & Service Providers Register
Who processes what, in which role and under which safeguard
What this register covers
The fact that a third party processes some data related to Alethexis does not make it a subprocessor of the Customer. The role depends on which data it processes and for which purpose. This register distinguishes three blocks.
This register is the living list referred to by the Data Processing Agreement (Annex II) and the Privacy Policy. It is updated whenever the provider, the contracting entity, the region, the purpose or the transfer mechanism changes.
Block 1 — DPA subprocessors (Customer Substantive Data)
They process Customer Substantive Data on the Customer's behalf, in accordance with Art. 28 of Regulation (EU) 2016/679. They are the only ones covered by the 30-day prior notice and the Customer's right to object.
| Provider | Purpose | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| Supabase | Database, authentication, storage and server functions | All product data | EU — Frankfurt (eu-central-1); entity in Singapore | Supabase DPA + Standard Contractual Clauses (Art. 46(2)(c)) for access from the entity in Singapore |
| Vercel | Application hosting and serverless functions in the EU region (fra1); global edge network | HTTP logs and request metadata; product data in transit | Compute in the EU (fra1); global edge network; US entity | Vercel DPA + Standard Contractual Clauses (Art. 46(2)(c)) + EU-US Data Privacy Framework |
| Cloudflare | DNS proxy, CDN, WAF and Turnstile (abuse protection) | Data in transit, IP addresses and browser signals | United States (proxy over all traffic) | Cloudflare DPA + Standard Contractual Clauses (Art. 46(2)(c)) + EU-US Data Privacy Framework |
Block 2 — Providers used by Alethexis as controller
They process Account Data, tax data, and email addresses and content, for Alethexis's own purposes: payments, invoicing and communications. They do not receive Customer Substantive Data, and are therefore not subprocessors of the Customer even though they are processors for Alethexis.
| Provider | Purpose | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| Stripe Payments Europe, Ltd. | Payments and subscriptions | Payment and billing data. Does not receive Substantive Data | Ireland; transfer to Stripe, LLC (United States); sub-processors in the United States, India and Canada | Stripe DPA (processor or independent controller depending on the operation) + Standard Contractual Clauses (Art. 46(2)(c)) + EU-US Data Privacy Framework |
| Holded Technologies, S.L. | Veri*factu invoicing and accounting | Customer tax data (tax ID, company name, amounts) | Spain; hosting in the EU; Salesforce in the United States | Holded DPA · Holded itself does not transfer; sub-processors outside the EEA: Standard Contractual Clauses (Art. 46(2)(c)) |
| Resend (Plus Five Five, Inc.) | Transactional email to users | Recipient address and account message content. Does not receive Substantive Data | United States (storage, whatever the sending region); delivery via eu-west-1 | Resend DPA + Standard Contractual Clauses (Art. 46(2)(c)) + EU-US Data Privacy Framework |
| Google Workspace | Alethexis email and calendar | Email content and attachments, sender and recipient data, and calendar events with their attendees | Entity in Ireland; processing in data centres of Google and its sub-processors, inside and outside the EU, including the United States | Google Cloud Data Processing Addendum + Standard Contractual Clauses (Art. 46(2)(c)) |
Block 3 — Tools without access to customer production data
Certain third parties used by Alethexis do not access Customer Substantive Data. This separation is structural and is supported by an internal operating rule that prevents personal data of customer production accounts from being extracted through development or verification tools. They are therefore not included as subprocessors.
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| GitHub | Source code repository | Source code. No customer data | United States (standard contractual clauses) |
| Anthropic | Claude models used in development | Development assistance tool. Not integrated into the application nor used to process customers' substantive content. Development access to production is subject to minimisation and restriction controls; its scope is kept documented and reviewed. | United States / EU depending on the endpoint |
International transfers
Where a provider processes data outside the European Economic Area, Alethexis relies on the Standard Contractual Clauses under Article 46(2)(c) of Regulation (EU) 2016/679, with the assessment and supplementary measures required. The mechanism for each provider is stated in the tables above.
Each provider's participation in the EU-US Data Privacy Framework was checked against the official list on 10/09/2026 and is checked again at every revision of this register.
Notification of changes
The addition or replacement of a Block 1 subprocessor is notified to customers 30 days in advance by email and by notice in the product. Customers may object in accordance with the Data Processing Agreement.
Languages and prevalence
This document is available in Spanish and English. Both versions state the same content. In the event of a discrepancy of interpretation, the Spanish version prevails, without prejudice to mandatory rules.