Legal / Subprocessors
Subprocessors
The provider categories currently used to host, secure, process and deliver ASAI Labs Auditing System.
This register reflects the provider categories and transfer descriptions in the current privacy notice. A customer-specific executed agreement or vendor change notice controls where it contains more specific terms.
| Provider | Service role | Data involved | Transfer / location note |
|---|---|---|---|
Cloudflare | Pages and application delivery, Workers, R2 object storage, queues, image sanitisation and approved image-processing infrastructure. | Application records, images, location data, IP addresses and technical logs as needed for the configured service. | EEA R2 storage jurisdiction; US recipient safeguards use the EU–US Data Privacy Framework where applicable, or SCCs with supplementary measures. |
Neon | Managed PostgreSQL database hosting, backups and recovery. | Account, organization, Store, contact, inspection, notification, location and related application records. | Production database region is configured in the EEA; US recipient safeguards use the EU–US Data Privacy Framework where applicable, or SCCs. |
Resend | Organization-directed transactional email delivery. | Recipient email address, Store or location name, inspection link, scheduled time and delivery records. | United States; EU–US Data Privacy Framework where applicable, or SCCs under the provider DPA. |
Twilio | Organization-directed SMS delivery. | Telephone number, Store or location name, inspection link and message delivery status. | United States and, where necessary, the destination associated with the recipient telephone number; BCRs or SCCs may apply. |
Browser Web Push providers | Delivery of notifications to a device after the user enables Web Push. | Push-subscription endpoint and keys, Protocol identifier, location title and inspection link; payloads are encrypted for delivery. | Destination depends on the browser or device selected; EU–US Data Privacy Framework or SCCs where applicable. |
Better Stack or approved telemetry endpoint | Payload-minimized server security and reliability telemetry. | Limited error and operational data; browser identity and session tracking are disabled in the approved baseline. | The active endpoint and applicable safeguard are confirmed in the current vendor register. |
Intercom | Optional customer-support chat after the user enables it. | Account or Store identifier, name, role, email when available, browser-session details and chat messages. | United States; EU–US Data Privacy Framework where applicable, with SCCs as a fallback. |
OpenStreetMap / Nominatim | Administrator-requested Store-address geocoding. | The address query, IP address and referrer may be disclosed to the geocoding provider by the current browser request. | Used only for requested geocoding; the provider's own terms and privacy notice apply to that external request. |
- Provider
- Cloudflare
- Service role
- Pages and application delivery, Workers, R2 object storage, queues, image sanitisation and approved image-processing infrastructure.
- Data involved
- Application records, images, location data, IP addresses and technical logs as needed for the configured service.
- Transfer / location note
- EEA R2 storage jurisdiction; US recipient safeguards use the EU–US Data Privacy Framework where applicable, or SCCs with supplementary measures.
- Provider
- Neon
- Service role
- Managed PostgreSQL database hosting, backups and recovery.
- Data involved
- Account, organization, Store, contact, inspection, notification, location and related application records.
- Transfer / location note
- Production database region is configured in the EEA; US recipient safeguards use the EU–US Data Privacy Framework where applicable, or SCCs.
- Provider
- Resend
- Service role
- Organization-directed transactional email delivery.
- Data involved
- Recipient email address, Store or location name, inspection link, scheduled time and delivery records.
- Transfer / location note
- United States; EU–US Data Privacy Framework where applicable, or SCCs under the provider DPA.
- Provider
- Twilio
- Service role
- Organization-directed SMS delivery.
- Data involved
- Telephone number, Store or location name, inspection link and message delivery status.
- Transfer / location note
- United States and, where necessary, the destination associated with the recipient telephone number; BCRs or SCCs may apply.
- Provider
- Browser Web Push providers
- Service role
- Delivery of notifications to a device after the user enables Web Push.
- Data involved
- Push-subscription endpoint and keys, Protocol identifier, location title and inspection link; payloads are encrypted for delivery.
- Transfer / location note
- Destination depends on the browser or device selected; EU–US Data Privacy Framework or SCCs where applicable.
- Provider
- Better Stack or approved telemetry endpoint
- Service role
- Payload-minimized server security and reliability telemetry.
- Data involved
- Limited error and operational data; browser identity and session tracking are disabled in the approved baseline.
- Transfer / location note
- The active endpoint and applicable safeguard are confirmed in the current vendor register.
- Provider
- Intercom
- Service role
- Optional customer-support chat after the user enables it.
- Data involved
- Account or Store identifier, name, role, email when available, browser-session details and chat messages.
- Transfer / location note
- United States; EU–US Data Privacy Framework where applicable, with SCCs as a fallback.
- Provider
- OpenStreetMap / Nominatim
- Service role
- Administrator-requested Store-address geocoding.
- Data involved
- The address query, IP address and referrer may be disclosed to the geocoding provider by the current browser request.
- Transfer / location note
- Used only for requested geocoding; the provider's own terms and privacy notice apply to that external request.
Change management
Provider updates
ASAI Labs will keep the active provider register versioned and make material changes available through the trust center or a customer channel as appropriate.
Questions
Need a transfer detail?
Ask for the applicable legal entity, processing country or transfer safeguard at [email protected].