Status: every row is a TEMPLATE entry. Do not publish until each provider contract, data processing addendum, data location, and transfer mechanism is confirmed. Status values: planned, contract pending, active, retired. Providers named below are those the plan expects; none is signed.
| Subprocessor | Purpose | Data categories | Location | Transfer mechanism | DPA | Status |
|---|---|---|---|---|---|---|
| [Cloud infrastructure provider] | Hosting, storage, queues, database | All service data | [US and global edge] | [DPF or clauses] | [pending] | planned |
| [Model provider A] | Text model inference | Prompts and outputs | [US] | [DPF or clauses] | [pending, zero retention, no training] | planned |
| [Model provider B] | Text model inference | Prompts and outputs | [US] | [DPF or clauses] | [pending, zero retention, no training] | planned |
| [Media provider] | Image, audio, video generation | Prompts, generated media | [US] | [DPF or clauses] | [pending] | planned |
| [Payment processor] | Payments and tax | Billing contact, payment tokens | [US] | [DPF or clauses] | [pending] | planned |
| [Email provider] | Transactional email | Email address, message | [US] | [DPF or clauses] | [pending] | planned |
| [Telephony provider] | Calls (gated feature) | Numbers, call audio | [US] | [DPF or clauses] | [pending] | planned |
| [Push services] | Notifications to devices | Device token, generic title | [US] | [DPF or clauses] | [pending] | planned |
| [Google, user connected] | Drive export and connectors, only at user request | Data user chooses | [US] | User directed | User terms | planned |
Notice rule: customers are told [30] days before a new subprocessor and may object (Regulation (EU) 2016/679, 2016, Art. 28(2)).
Open questions for counsel #
- Which provider contracts include zero retention and no training terms (Q13), and whether any provider offers a business associate agreement (unverified).
- Which rows may be named publicly before launch.