Legal
Sub-processor list
ScaleAxis engages the following Sub-processors to provide the Service. ScaleAxis will give at least thirty (30) days' advance notice before adding or replacing a Sub-processor by (a) updating this list, (b) sending email to the account administrator, and (c) in-product notice. Subscribe to updates at scaleaxis.ai/subprocessors.
| # | Sub-processor | Purpose | Data Categories | Location | Privacy / DPA Reference |
|---|---|---|---|---|---|
| 1 | Vercel Inc. | Hosting, edge runtime, CDN for ScaleAxis OS production | Customer Data in transit; request logs | United States (primarily) | vercel.com/legal/privacy-policy; vercel.com/legal/dpa |
| 2 | Supabase Inc. | Database (PostgreSQL), authentication, object storage | Customer Data at rest; auth metadata; file storage | AWS US (region selected by ScaleAxis, e.g., us-east-1 or us-west-2) | supabase.com/privacy; supabase.com/legal/dpa |
| 3 | Stripe, Inc. | Payment processing, metered billing for AI Overage Fees, customer billing | Billing names, addresses, payment card data (handled by Stripe; ScaleAxis does not store full card numbers), transaction data | United States | stripe.com/privacy; stripe.com/legal/dpa |
| 4 | Twilio Inc. | SMS, MMS, voice, phone-number provisioning, A2P 10DLC registration | Phone numbers; message content; call metadata; brand/campaign registration data | United States | twilio.com/en-us/legal/privacy; twilio.com/en-us/legal/data-protection-addendum |
| 5 | Resend (Plus Five Five, Inc.) | Transactional and marketing email | Sender/recipient email addresses; email content; delivery logs | United States | resend.com/legal/privacy-policy; resend.com/legal/dpa |
| 6 | OpenRouter, Inc. | AI inference gateway: every AI Features request is routed through OpenRouter | Prompts, AI Output, AI Business Context excerpts at inference time | United States | openrouter.ai/privacy; openrouter.ai/terms |
| 7 | Anthropic, PBC | Model provider for AI Features, reached via OpenRouter | Prompts, AI Output, AI Business Context excerpts at inference time | United States | anthropic.com/legal/privacy; anthropic.com/legal/commercial-terms (which states: "Anthropic may not train models on Customer Content from Services") |
| 8 | Functional Software, Inc. (Sentry) | Application error monitoring | Error events with user and organization identifiers; request metadata | United States | sentry.io/privacy; sentry.io/legal/dpa |
| 9 | Upstash, Inc. | Redis-backed rate limiting | Request identifiers and counters | United States | upstash.com/trust/privacy.pdf; upstash.com/trust/dpa.pdf |
| 10 | Cloudflare, Inc. | Turnstile bot protection on sign-in and sign-up | Challenge tokens; IP address at challenge time | United States | cloudflare.com/privacypolicy; cloudflare.com/cloudflare-customer-dpa |
Integrations you connect
These providers receive Customer Data only when Customer connects the integration, and only for as long as it stays connected.
| Provider | Purpose | Data Categories | Privacy Reference |
|---|---|---|---|
| Google LLC | Sign-in with Google; Google Calendar scheduling | Account email and profile identifiers; calendar event content | policies.google.com/privacy |
| Microsoft Corporation | Outlook and Microsoft 365 calendar scheduling | Account identifiers; calendar event content | privacy.microsoft.com/privacystatement |
| Zoom Communications, Inc. | Meeting provisioning for scheduled bookings | Meeting metadata; host and invitee identifiers | zoom.com/trust/privacy |
Important. All Sub-processors are bound by data-protection terms at least equivalent to the DPA. ScaleAxis remains liable for the acts and omissions of its Sub-processors, subject to the limitations of liability in the MSA.