Sub-processors
The service providers that process data on ADEXMA's behalf, where they do it, and on what legal basis it crosses a border.
Last updated: 2026-08-16 · Version 1.0
How this list works
ADEXMA LLC engages the providers below to host, store, process and monitor the data of its clients and of this website. Each is bound by a written data-processing agreement. Lane says which deployment lane or module a provider serves — a provider outside your engagement's lane does not process your data. Transfer mechanism is the legal basis relied on when data of individuals in the EEA, UK or Switzerland is processed outside those territories; where a provider is certified under the EU-U.S. Data Privacy Framework, that certification is an additional basis, not a substitute for the Standard Contractual Clauses.
Clients under a Data Processing Agreement receive thirty (30) days' notice of any addition or replacement by email and by an update to this page, and may object on reasonable data-protection grounds. To receive notices, write to clerouge@adexma.com.
Current sub-processors
| Provider | Service and data processed | Processing location | Lane / module | Transfer mechanism | Assurance |
|---|---|---|---|---|---|
| Supabase, Inc.USA | Managed PostgreSQL database, authentication, object storageWorkspace records, users, audit trail, knowledge index; documents on the portal-vault storage lane | US lane: AWS us-west-2 (Oregon). EU lane: AWS eu-west-3 (Paris) after cutover — interim us-west-2 | All | SCCs 2021/914 + transfer impact assessment | SOC 2 Type II · ISO/IEC 27001:2022 |
| Vercel Inc.USA | Application hosting and compute, CDN, request logsRequest data in transit, session tokens, server logs | US lane: pdx1 (Portland). EU lane: cdg1 (Paris) after cutover — interim pdx1 | All | EU-U.S. Data Privacy Framework + SCCs | SOC 2 Type II · ISO/IEC 27001:2022 · PCI DSS SAQ |
| Scaleway SASFrance | Object storage; Generative APIs (Mistral models)Uploaded documents (EU storage lane); AI prompts and completions (EU model lane) | fr-par (Paris) | EU lane | None required (EU) | ISO/IEC 27001:2022 · HDS · CSA STAR L1 — not SecNumCloud-qualified (in progress) |
| Mistral AI SASFrance | Document OCR; language-model inference (direct API)Document images and extracted text; prompts and completions | European Union (France) | EU lane | None required (EU) | SOC 2 Type II · ISO/IEC 27001 / 27701 · zero-data-retention available on request · no training on API inputs |
| Anthropic, PBCUSA | Language-model inference (Claude)Prompts including grounding excerpts, completions | USA | US lane (default model) | SCCs (Anthropic DPA) | SOC 2 Type II · ISO/IEC 27001 · ISO/IEC 42001 · no training on commercial inputs/outputs |
| Microsoft CorporationUSA | Azure AI Foundry — model inference and Mistral OCR (US lane); Microsoft 365 / OneDrive (ADEXMA OneDrive storage lane)Prompts and completions; document images (OCR); documents on the OneDrive lane | eastus2 (USA); Microsoft 365 US geography | US lane; OneDrive lane where selected | EU-U.S. Data Privacy Framework + SCCs (Microsoft DPA) | SOC 2 · ISO/IEC 27001 / 27018 |
| Google LLCUSA | Gemini API — language-model inference (US fallback lane)Prompts and completions | USA | US lane (fallback only) | EU-U.S. Data Privacy Framework + SCCs | ISO/IEC 27001 · SOC 2 · no training on paid API inputs |
| Unipile SASFrance | Email, calendar and messaging connectors (Connected Accounts module)Mailbox, calendar and messaging content and contacts of the accounts a client connects | France (Scaleway datacentres) | Only when the Connected Accounts module is enabled | None required (EU) | SOC 2 Type II · AES-256-GCM at rest |
| Resend, Inc.USA | Transactional email — sign-in codes, invitations, notificationsRecipient email address, message metadata | USA (account data, logs); EU (Ireland) sending region available | All | EU-U.S. Data Privacy Framework (EU + UK extension) + SCCs | SOC 2 |
| Functional Software, Inc. (Sentry)USA | Application error monitoringError type, message, stack trace, release, environment — no request bodies, headers, cookies or query strings | USA (EU region planned with the EU cutover) | All | EU-U.S. Data Privacy Framework + SCCs | SOC 2 Type II |
| Infomaniak Network SASwitzerland | Email transit for ADEXMA correspondenceEmail content and metadata of correspondence with clients | Switzerland (adequacy decision) | Correspondence only — not in the portal data path | Adequacy (Switzerland) | ISO/IEC 27001 |
| Cloudflare, Inc.USA | DNS, TLS termination and access proxy for adexma.com and adjacent hostsConnection metadata for the marketing site and tunnelled hosts — not the portal application traffic | Global edge (US-headquartered) | Adjacent hosts only | EU-U.S. Data Privacy Framework + SCCs | ISO/IEC 27001 / 27701 · SOC 2 |
| Amazon Web Services, Inc.USAConditional | Amazon Bedrock (Claude in EU regions or in AWS GovCloud) — conditionalPrompts and completions | EU regions (capability tier) or US GovCloud (gated tier) | Only if recorded in the client's engagement profile | EU-U.S. Data Privacy Framework + SCCs | SOC 2 · ISO/IEC 27001 · FedRAMP (GovCloud) |
| Google Cloud (Vertex AI)USAConditional | Claude / Gemini in EU multi-region — conditionalPrompts and completions | EU regions | Only if recorded in the client's engagement profile | EU-U.S. Data Privacy Framework + SCCs | ISO/IEC 27001 · SOC 2 |
Not sub-processors
- A client's own Microsoft 365 / SharePoint tenant (Client OneDrive storage lane) — the client's processor, not ADEXMA's.
- On-premise model hosting — retired as an offering on 4 August 2026; no on-premise sub-processor exists.
- Stripe and QuickBooks Online — process ADEXMA's own billing data (see the privacy policy), not client workspace data.
Change log. v1.0 — 16 August 2026 — initial publication (14 entries, 2 conditional).