Sub-processors
The service providers that process data on ADEXMA's behalf, where they do it, and on what legal basis it crosses a border.
Last updated: 2026-10-06 · Version 1.4
How this list works
ADEXMA LLC engages the providers below to host, store, process and monitor the data of its clients and of this website. Each is bound by a written data-processing agreement. Lane says which deployment lane or module a provider serves — a provider outside your engagement's lane does not process your data. Transfer mechanism is the legal basis relied on when data of individuals in the EEA, UK or Switzerland is processed outside those territories; where a provider is certified under the EU-U.S. Data Privacy Framework, that certification is an additional basis, not a substitute for the Standard Contractual Clauses.
Clients under a Data Processing Agreement receive thirty (30) days' notice of any addition or replacement by email and by an update to this page, and may object on reasonable data-protection grounds. To receive notices, write to clerouge@adexma.com.
Current sub-processors
US lane — app.adexma.com
| Provider | Service and data processed | Processing location | Transfer mechanism | Retention | Assurance |
|---|---|---|---|---|---|
| Supabase, Inc.USA | Managed PostgreSQL database, authentication, object storageWorkspace records, users and sign-in data, audit trail, knowledge index; documents on the portal-vault storage lane | AWS us-west-2 (Oregon, USA) | SCCs (2021/914) — with a transfer impact assessment; not DPF-certified | For the term of the engagement, deleted within 30 days of its end; Supabase's managed back-ups roll off after 7 days (Pro plan) | SOC 2 Type II · ISO/IEC 27001:2022 |
| Vercel Inc.USA | Application hosting and compute, CDN, request logsRequest data in transit, session tokens, server logs | pdx1 (Portland, USA) | EU-U.S. Data Privacy Framework + SCCs (2021/914) | No application data at rest; runtime logs kept 1 day (Pro plan) | SOC 2 Type II · ISO/IEC 27001:2022 · PCI DSS SAQ |
| Scaleway SASFrance | Object storage; Generative APIs (Mistral models)Uploaded documents (EU storage lane); AI prompts and completions (EU model lane); ADEXMA's daily copy of each lane's database (both lanes) | fr-par (Paris, France) — database copies only | None required (EU) | Documents for the term of the engagement; Generative APIs keep no prompts or completions by default (zero data retention is Scaleway's default, nothing to request); database copies expire after 30 days | ISO/IEC 27001:2022 · HDS · CSA STAR L1 — not SecNumCloud-qualified |
| Mistral AI SASFrance | Document OCR (EU lane, and the US lane's default for commercial engagements since 22 October 2026); language-model inference (direct API, EU lane)Document images and extracted text; prompts and completions | European Union (France) — OCR only | None required (EU) | Inputs and outputs kept 30 rolling days for abuse monitoring; zero-data-retention available on request, NOT currently requested by ADEXMA | SOC 2 Type II · ISO/IEC 27001 / 27701 · no training on API inputs |
| Anthropic, PBCUSA | Language-model inference (Claude)Prompts including grounding excerpts, completions | USA | SCCs (2021/914) — Anthropic DPA, Modules 2/3 + UK/Swiss addenda; not DPF-certified | Inputs and outputs deleted within 30 days (longer only for content flagged under the usage policy); zero data retention only under a separate agreement, NOT currently requested by ADEXMA | SOC 2 Type II · ISO/IEC 27001 · ISO/IEC 42001 · no training on commercial inputs/outputs |
| Microsoft CorporationUSA | Azure AI Foundry — model inference, and Mistral OCR for US tiers other than commercial or where ADEXMA selects it; Microsoft Graph — reading the SharePoint folder a client shares; Microsoft 365 / OneDrive (ADEXMA OneDrive storage lane)Prompts and completions; document images (OCR); files read from a shared folder; documents on the OneDrive laneUS lane only — the EU deployment holds no Microsoft credentials | eastus2 (USA); Microsoft 365 US geography | EU-U.S. Data Privacy Framework + SCCs (2021/914) | Foundry: prompts and completions may be stored for abuse monitoring in the resource's region unless Microsoft approves modified abuse monitoring — NOT currently requested by ADEXMA; Claude models on Foundry follow Anthropic's retention; OneDrive documents for the term of the engagement | SOC 2 · ISO/IEC 27001 / 27018 |
| Unipile SASFrance | Email, calendar and messaging connectors (Connected Accounts module)Mailbox, calendar and messaging content and contacts of the accounts a client connects; and, where email tracking is enabled, open and click events including the reader's IP address and device, which Unipile processes to record the event and which ADEXMA does not storeOnly when the Connected Accounts module is enabled | France (Scaleway and OVH datacentres) | None required (EU) | While the account stays connected; deleted when the account is disconnected or at the end of the contract | SOC 2 Type II · AES-256-GCM at rest |
| Resend, Inc.USA | Transactional email — sign-in codes, invitations, notificationsRecipient email address, message content and metadata | Sends from us-east-1 (USA); account data and logs in the USA | EU-U.S. Data Privacy Framework + SCCs (2021/914) | Email and log data kept 30 days; account data deleted within 90 days of the end of the account | SOC 2 |
| Functional Software, Inc. (Sentry)USA | Application error monitoring for the US laneError type, message, stack trace, release, environment — no request bodies, headers, cookies or query stringsUS lane only — the EU lane reports to GlitchTip in the Paris region | USA | EU-U.S. Data Privacy Framework + SCCs (2021/914) | 90 days (Team and Business plans) | SOC 2 Type II |
| Infomaniak Network SASwitzerland | Email transit for ADEXMA correspondenceEmail content and metadata of correspondence with clientsCorrespondence only — not in the portal data path | Switzerland | Adequacy decision | As long as ADEXMA keeps the correspondence (privacy policy §6) | ISO/IEC 27001 |
| Cloudflare, Inc.USA | DNS, TLS termination and access proxy for adexma.com and adjacent hostsConnection metadata for the marketing site and tunnelled hosts — not the portal application trafficAdjacent hosts only | Global edge (US-headquartered) | EU-U.S. Data Privacy Framework + SCCs (2021/914) | Request logs not retained by default (log retention is not switched on) | ISO/IEC 27001 / 27701 · SOC 2 |
EU lane — app.adexma.eu
| Provider | Service and data processed | Processing location | Transfer mechanism | Retention | Assurance |
|---|---|---|---|---|---|
| Supabase, Inc.USA | Managed PostgreSQL database, authentication, object storageWorkspace records, users and sign-in data, audit trail, knowledge index; documents on the portal-vault storage lane | AWS eu-west-3 (Paris region) | SCCs (2021/914) — with a transfer impact assessment; not DPF-certified | For the term of the engagement, deleted within 30 days of its end; Supabase's managed back-ups roll off after 7 days (Pro plan) | SOC 2 Type II · ISO/IEC 27001:2022 |
| Vercel Inc.USA | Application hosting and compute, CDN, request logsRequest data in transit, session tokens, server logs | cdg1 (Paris region) | EU-U.S. Data Privacy Framework + SCCs (2021/914) | No application data at rest; runtime logs kept 1 day (Pro plan) | SOC 2 Type II · ISO/IEC 27001:2022 · PCI DSS SAQ |
| Scaleway SASFrance | Object storage; Generative APIs (Mistral models)Uploaded documents (EU storage lane); AI prompts and completions (EU model lane); ADEXMA's daily copy of each lane's database (both lanes) | fr-par (Paris region) | None required (EU) | Documents for the term of the engagement; Generative APIs keep no prompts or completions by default (zero data retention is Scaleway's default, nothing to request); database copies expire after 30 days | ISO/IEC 27001:2022 · HDS · CSA STAR L1 — not SecNumCloud-qualified |
| Scaleway SAS — GlitchTip error monitoring, operated by ADEXMAFrance | Application error monitoring for the EU lane (self-hosted GlitchTip at errors.adexma.eu, on a Scaleway server)Error type, message, stack trace, release, environment — no request bodies, headers, cookies or query strings | fr-par-1 (Paris region) | None required (EU) | 30 days (ADEXMA's setting); server back-ups 7 days | Scaleway: ISO/IEC 27001:2022 · HDS — GlitchTip itself is operated by ADEXMA |
| Mistral AI SASFrance | Document OCR (EU lane, and the US lane's default for commercial engagements since 22 October 2026); language-model inference (direct API, EU lane)Document images and extracted text; prompts and completions | European Union (France) | None required (EU) | Inputs and outputs kept 30 rolling days for abuse monitoring; zero-data-retention available on request, NOT currently requested by ADEXMA | SOC 2 Type II · ISO/IEC 27001 / 27701 · no training on API inputs |
| Unipile SASFrance | Email, calendar and messaging connectors (Connected Accounts module)Mailbox, calendar and messaging content and contacts of the accounts a client connects; and, where email tracking is enabled, open and click events including the reader's IP address and device, which Unipile processes to record the event and which ADEXMA does not storeOnly when the Connected Accounts module is enabled | France (Scaleway and OVH datacentres) | None required (EU) | While the account stays connected; deleted when the account is disconnected or at the end of the contract | SOC 2 Type II · AES-256-GCM at rest |
| Resend, Inc.USA | Transactional email — sign-in codes, invitations, notificationsRecipient email address, message content and metadata | Sends from eu-west-1 (Ireland) at send.adexma.eu; account data and logs in the USA | EU-U.S. Data Privacy Framework + SCCs (2021/914) | Email and log data kept 30 days; account data deleted within 90 days of the end of the account | SOC 2 |
| Infomaniak Network SASwitzerland | Email transit for ADEXMA correspondenceEmail content and metadata of correspondence with clientsCorrespondence only — not in the portal data path | Switzerland | Adequacy decision | As long as ADEXMA keeps the correspondence (privacy policy §6) | ISO/IEC 27001 |
| Cloudflare, Inc.USA | DNS, TLS termination and access proxy for adexma.com and adjacent hostsConnection metadata for the marketing site and tunnelled hosts — not the portal application trafficAdjacent hosts only | Global edge (US-headquartered) | EU-U.S. Data Privacy Framework + SCCs (2021/914) | Request logs not retained by default (log retention is not switched on) | ISO/IEC 27001 / 27701 · SOC 2 |
Other providers (not sub-processors)
| Provider | Service and data processed | Processing location | Role | Retention | Assurance |
|---|---|---|---|---|---|
| Slack Technologies, LLCUSA | A member's own Slack direct messages, read when that person connects Slack (one ADEXMA app per region)Direct messages and the names and emails of the other participantsOnly when a member connects Slack | The client's Slack workspace | The client's own system | Set by the client's own Slack workspace; ADEXMA keeps what it reads like other workspace activity | Under the client's own contract with Slack · Slack is DPF-certified (Salesforce) |
| Stripe, LLCUSA | ADEXMA's own billing records; and, separately, a Stripe account a client connects for data intake (the client's own system)Billing contact and payment records | USA | ADEXMA's own billing | As long as the service is provided, then as financial record-keeping law requires | PCI DSS Level 1 · SOC 2 |
| Intuit Inc. (QuickBooks Online)USA | A QuickBooks Online company a client connects for data intake; also ADEXMA's own accountingThe accounting records the client grants | The client's QuickBooks Online company | The client's own system | Set by the client's own QuickBooks Online company | Under the client's own contract with Intuit |
Not sub-processors
- A client's own Microsoft 365 / SharePoint tenant (Client OneDrive storage lane) — the client's processor, not ADEXMA's.
- On-premise model hosting — retired as an offering on 4 August 2026; no on-premise sub-processor exists.
- Stripe and QuickBooks Online — process ADEXMA's own billing data (see the privacy policy), not client workspace data. A Stripe or QuickBooks Online account that a client connects for data intake is that client's own system (next line).
- A client's own systems that the client connects for data intake — one SharePoint site in its Microsoft 365 (shared folder), or its ERP or accounting system (Epicor, SAP, Odoo, QuickBooks Online, Stripe or another) — are the client's processors, not ADEXMA's. ADEXMA reads only what the client grants, with credentials or access the client gives, and writes to them only where the client has signed the ERP write-back addendum: NetSuite customers, contacts, opportunities, estimates and sales orders, approved by ADEXMA staff batch by batch, never deleted.
- Files a client sends with a workspace key, from its own script or AI assistant, go straight to the workspace's own storage lane. No third party is involved.
Change log. v1.0 — 16 August 2026 — initial publication (14 entries, 2 conditional). v1.2 — 11 September 2026 — three entries removed: Google LLC (Gemini API), Amazon Web Services (Amazon Bedrock, conditional) and Google Cloud (Vertex AI, conditional); 11 entries, none conditional. v1.1 (10 September 2026) amended only the DPA's Data Location Schedule and did not change this list. v1.3 — 27 September 2026 — no entry added or removed; the Unipile entry now states that, where email tracking is enabled, it processes open and click events including the reader's IP address and device. v1.4 — 28 September 2026 — no entry added or removed; "Not sub-processors" now names the client's own systems a client connects for data intake (a SharePoint site, an ERP or accounting system) and states that files sent with a workspace key involve no third party. v1.5 — 22 October 2026 — the register is set out per lane (US and EU), and every entry states its retention. The EU lane's error monitoring is GlitchTip, operated by ADEXMA on a Scaleway server in the Paris region, since 12 September 2026 (the Sentry entry now covers the US lane only); Resend's entry names the EU sending region (Ireland) in use and the account data it keeps in the United States. Mistral AI's entry covers the US lane too: it is the default OCR for US commercial engagements since 22 October 2026 (processed in France). No processor of client data was engaged anew. Slack, Stripe and Intuit (QuickBooks Online) are now listed under "Other providers" with their roles: they are a client's own systems or ADEXMA's own billing, not sub-processors. The EU lane is described as "EU-hosted (Paris region), with named US sub-processors under SCCs".