Sub-processors

The service providers that process data on ADEXMA's behalf, where they do it, and on what legal basis it crosses a border.

Last updated: 2026-10-06 · Version 1.4

How this list works

ADEXMA LLC engages the providers below to host, store, process and monitor the data of its clients and of this website. Each is bound by a written data-processing agreement. Lane says which deployment lane or module a provider serves — a provider outside your engagement's lane does not process your data. Transfer mechanism is the legal basis relied on when data of individuals in the EEA, UK or Switzerland is processed outside those territories; where a provider is certified under the EU-U.S. Data Privacy Framework, that certification is an additional basis, not a substitute for the Standard Contractual Clauses.

Clients under a Data Processing Agreement receive thirty (30) days' notice of any addition or replacement by email and by an update to this page, and may object on reasonable data-protection grounds. To receive notices, write to clerouge@adexma.com.

Where the EU lane runs, stated plainly: for EU-resident engagements the documents, the AI processing, the application database, authentication and the knowledge index all run in France — Scaleway and Mistral AI for storage and models, Supabase eu-west-3 and Vercel cdg1 for the application. The cutover completed in September 2026; until then the database, authentication and knowledge index ran in the United States (Supabase us-west-2, Vercel pdx1), and this page said so. One exception, stated because this page exists to state exactly this: contact records in ADEXMA's own client-relationship store did not move with the engagements. For at least one EU engagement they remain in the United States and are still updated there. A small, separate set of contact records also sits in Paris — different people, not a copy of the US ones — written once in June 2026 and unchanged since. Contact data for that context is therefore split across both countries rather than duplicated in one of them. Both sets are covered by the Standard Contractual Clauses in the table below, and consolidating them is open work. ADEXMA still describes the EU lane as "hosted in France" and never as "sovereign": several providers are US-headquartered and remain subject to US law wherever their infrastructure sits, which is why the Standard Contractual Clauses in the table below still apply and are not made redundant by the cutover.

Current sub-processors

Provider	Service and data processed	Processing location	Lane / module	Transfer mechanism	Assurance
Supabase, Inc.USA	Managed PostgreSQL database, authentication, object storageWorkspace records, users, audit trail, knowledge index; documents on the portal-vault storage lane	US lane: AWS us-west-2 (Oregon). EU lane: AWS eu-west-3 (Paris)	All	SCCs 2021/914 + transfer impact assessment	SOC 2 Type II · ISO/IEC 27001:2022
Vercel Inc.USA	Application hosting and compute, CDN, request logsRequest data in transit, session tokens, server logs	US lane: pdx1 (Portland). EU lane: cdg1 (Paris)	All	EU-U.S. Data Privacy Framework + SCCs	SOC 2 Type II · ISO/IEC 27001:2022 · PCI DSS SAQ
Scaleway SASFrance	Object storage; Generative APIs (Mistral models)Uploaded documents (EU storage lane); AI prompts and completions (EU model lane)	fr-par (Paris)	EU lane	None required (EU)	ISO/IEC 27001:2022 · HDS · CSA STAR L1 — not SecNumCloud-qualified (in progress)
Mistral AI SASFrance	Document OCR; language-model inference (direct API)Document images and extracted text; prompts and completions	European Union (France)	EU lane	None required (EU)	SOC 2 Type II · ISO/IEC 27001 / 27701 · no training on API inputs · zero-data-retention available on request, NOT currently requested by ADEXMA
Anthropic, PBCUSA	Language-model inference (Claude)Prompts including grounding excerpts, completions	USA	US lane (default model)	SCCs (Anthropic DPA)	SOC 2 Type II · ISO/IEC 27001 · ISO/IEC 42001 · no training on commercial inputs/outputs
Microsoft CorporationUSA	Azure AI Foundry — model inference and Mistral OCR (US lane); Microsoft 365 / OneDrive (ADEXMA OneDrive storage lane)Prompts and completions; document images (OCR); documents on the OneDrive lane	eastus2 (USA); Microsoft 365 US geography	US lane; OneDrive lane where selected	EU-U.S. Data Privacy Framework + SCCs (Microsoft DPA)	SOC 2 · ISO/IEC 27001 / 27018
Unipile SASFrance	Email, calendar and messaging connectors (Connected Accounts module)Mailbox, calendar and messaging content and contacts of the accounts a client connects; and, where email tracking is enabled, open and click events including the reader's IP address and device, which Unipile processes to record the event and which ADEXMA does not store	France (Scaleway datacentres)	Only when the Connected Accounts module is enabled	None required (EU)	SOC 2 Type II · AES-256-GCM at rest
Resend, Inc.USA	Transactional email — sign-in codes, invitations, notificationsRecipient email address, message metadata	USA (account data, logs); EU (Ireland) sending region available	All	EU-U.S. Data Privacy Framework (EU + UK extension) + SCCs	SOC 2
Functional Software, Inc. (Sentry)USA	Application error monitoringError type, message, stack trace, release, environment — no request bodies, headers, cookies or query strings	USA (EU region planned with the EU cutover)	All	EU-U.S. Data Privacy Framework + SCCs	SOC 2 Type II
Infomaniak Network SASwitzerland	Email transit for ADEXMA correspondenceEmail content and metadata of correspondence with clients	Switzerland (adequacy decision)	Correspondence only — not in the portal data path	Adequacy (Switzerland)	ISO/IEC 27001
Cloudflare, Inc.USA	DNS, TLS termination and access proxy for adexma.com and adjacent hostsConnection metadata for the marketing site and tunnelled hosts — not the portal application traffic	Global edge (US-headquartered)	Adjacent hosts only	EU-U.S. Data Privacy Framework + SCCs	ISO/IEC 27001 / 27701 · SOC 2

Not sub-processors

A client's own Microsoft 365 / SharePoint tenant (Client OneDrive storage lane) — the client's processor, not ADEXMA's.
On-premise model hosting — retired as an offering on 4 August 2026; no on-premise sub-processor exists.
Stripe and QuickBooks Online — process ADEXMA's own billing data (see the privacy policy), not client workspace data. A Stripe or QuickBooks Online account that a client connects for data intake is that client's own system (next line).
A client's own systems that the client connects for data intake — one SharePoint site in its Microsoft 365 (shared folder), or its ERP or accounting system (Epicor, SAP, Odoo, QuickBooks Online, Stripe or another) — are the client's processors, not ADEXMA's. ADEXMA reads only what the client grants, with credentials or access the client gives, and writes to them only where the client has signed the ERP write-back addendum: NetSuite customers, contacts, opportunities, estimates and sales orders, approved by ADEXMA staff batch by batch, never deleted.
Files a client sends with a workspace key, from its own script or AI assistant, go straight to the workspace's own storage lane. No third party is involved.

Change log. v1.0 — 16 August 2026 — initial publication (14 entries, 2 conditional). v1.2 — 11 September 2026 — three entries removed: Google LLC (Gemini API), Amazon Web Services (Amazon Bedrock, conditional) and Google Cloud (Vertex AI, conditional); 11 entries, none conditional. v1.1 (10 September 2026) amended only the DPA's Data Location Schedule and did not change this list. v1.3 — 27 September 2026 — no entry added or removed; the Unipile entry now states that, where email tracking is enabled, it processes open and click events including the reader's IP address and device. v1.4 — 28 September 2026 — no entry added or removed; "Not sub-processors" now names the client's own systems a client connects for data intake (a SharePoint site, an ERP or accounting system) and states that files sent with a workspace key involve no third party.

How this list works

Current sub-processors

Provider	Service and data processed	Processing location	Lane / module	Transfer mechanism	Assurance
Supabase, Inc.USA	Managed PostgreSQL database, authentication, object storageWorkspace records, users, audit trail, knowledge index; documents on the portal-vault storage lane	US lane: AWS us-west-2 (Oregon). EU lane: AWS eu-west-3 (Paris)	All	SCCs 2021/914 + transfer impact assessment	SOC 2 Type II · ISO/IEC 27001:2022
Vercel Inc.USA	Application hosting and compute, CDN, request logsRequest data in transit, session tokens, server logs	US lane: pdx1 (Portland). EU lane: cdg1 (Paris)	All	EU-U.S. Data Privacy Framework + SCCs	SOC 2 Type II · ISO/IEC 27001:2022 · PCI DSS SAQ
Scaleway SASFrance	Object storage; Generative APIs (Mistral models)Uploaded documents (EU storage lane); AI prompts and completions (EU model lane)	fr-par (Paris)	EU lane	None required (EU)	ISO/IEC 27001:2022 · HDS · CSA STAR L1 — not SecNumCloud-qualified (in progress)
Mistral AI SASFrance	Document OCR; language-model inference (direct API)Document images and extracted text; prompts and completions	European Union (France)	EU lane	None required (EU)	SOC 2 Type II · ISO/IEC 27001 / 27701 · no training on API inputs · zero-data-retention available on request, NOT currently requested by ADEXMA
Anthropic, PBCUSA	Language-model inference (Claude)Prompts including grounding excerpts, completions	USA	US lane (default model)	SCCs (Anthropic DPA)	SOC 2 Type II · ISO/IEC 27001 · ISO/IEC 42001 · no training on commercial inputs/outputs
Microsoft CorporationUSA	Azure AI Foundry — model inference and Mistral OCR (US lane); Microsoft 365 / OneDrive (ADEXMA OneDrive storage lane)Prompts and completions; document images (OCR); documents on the OneDrive lane	eastus2 (USA); Microsoft 365 US geography	US lane; OneDrive lane where selected	EU-U.S. Data Privacy Framework + SCCs (Microsoft DPA)	SOC 2 · ISO/IEC 27001 / 27018
Unipile SASFrance	Email, calendar and messaging connectors (Connected Accounts module)Mailbox, calendar and messaging content and contacts of the accounts a client connects; and, where email tracking is enabled, open and click events including the reader's IP address and device, which Unipile processes to record the event and which ADEXMA does not store	France (Scaleway datacentres)	Only when the Connected Accounts module is enabled	None required (EU)	SOC 2 Type II · AES-256-GCM at rest
Resend, Inc.USA	Transactional email — sign-in codes, invitations, notificationsRecipient email address, message metadata	USA (account data, logs); EU (Ireland) sending region available	All	EU-U.S. Data Privacy Framework (EU + UK extension) + SCCs	SOC 2
Functional Software, Inc. (Sentry)USA	Application error monitoringError type, message, stack trace, release, environment — no request bodies, headers, cookies or query strings	USA (EU region planned with the EU cutover)	All	EU-U.S. Data Privacy Framework + SCCs	SOC 2 Type II
Infomaniak Network SASwitzerland	Email transit for ADEXMA correspondenceEmail content and metadata of correspondence with clients	Switzerland (adequacy decision)	Correspondence only — not in the portal data path	Adequacy (Switzerland)	ISO/IEC 27001
Cloudflare, Inc.USA	DNS, TLS termination and access proxy for adexma.com and adjacent hostsConnection metadata for the marketing site and tunnelled hosts — not the portal application traffic	Global edge (US-headquartered)	Adjacent hosts only	EU-U.S. Data Privacy Framework + SCCs	ISO/IEC 27001 / 27701 · SOC 2

Not sub-processors

A client's own Microsoft 365 / SharePoint tenant (Client OneDrive storage lane) — the client's processor, not ADEXMA's.

On-premise model hosting — retired as an offering on 4 August 2026; no on-premise sub-processor exists.

Stripe and QuickBooks Online — process ADEXMA's own billing data (see the privacy policy), not client workspace data. A Stripe or QuickBooks Online account that a client connects for data intake is that client's own system (next line).

A client's own systems that the client connects for data intake — one SharePoint site in its Microsoft 365 (shared folder), or its ERP or accounting system (Epicor, SAP, Odoo, QuickBooks Online, Stripe or another) — are the client's processors, not ADEXMA's. ADEXMA reads only what the client grants, with credentials or access the client gives, and writes to them only where the client has signed the ERP write-back addendum: NetSuite customers, contacts, opportunities, estimates and sales orders, approved by ADEXMA staff batch by batch, never deleted.

Files a client sends with a workspace key, from its own script or AI assistant, go straight to the workspace's own storage lane. No third party is involved.