Subprocessors
The vetted third parties that help us run Exeaura OS. We update this page whenever we add, remove, or change a subprocessor.
1. Current subprocessors
| Processor | Purpose | Data | Location | Safeguards |
|---|---|---|---|---|
| Supabase (Postgres, Auth, Storage) | Primary database, authentication and file storage | Account, profile, generated content, files, auth tokens | EU (Ireland) | DPA, encryption at rest and in transit, SOC 2 Type II |
| OpenAI | AI-assisted reasoning, drafting and selected media generation | Relevant prompts, context and generated responses | Processing locations depend on the applicable service and configuration | API data controls and applicable contractual terms; retention and available controls depend on the account configuration |
| Google (Gemini) | Multimodal AI processing, analysis and generation | Relevant prompts, context, images and generated responses | Processing locations depend on the applicable service and configuration | Service-tier data policies and applicable contractual settings; training and retention terms vary by service configuration |
| Stripe | Payment processing, invoicing and tax | Billing metadata, invoice records | United States / EU | PCI-DSS Level 1, DPA, SCCs |
| Cloudflare | Application hosting, CDN, edge compute | Request metadata, static assets, SSR responses | Global edge | DPA, TLS termination, DDoS protection, SOC 2 |
| PostHog | Product analytics (opt-in only) | De-identified usage events, device metadata | EU (Frankfurt) | DPA, consent-gated, EU residency |
| Sentry | Error monitoring and performance tracing | Stack traces, request context, user id | United States / EU | DPA, PII scrubbing, SCCs |
| Mailgun | Transactional and authentication email delivery | Email address, message content, delivery metadata | United States / EU | DPA, TLS, suppression lists, SCCs |
| LinkedIn (via user OAuth) | Publishing to the user's own LinkedIn profile | OAuth token, posts submitted by user | United States | User-authorised OAuth scope, revocable at any time |
2. Notification of changes
We publish this list before onboarding a new subprocessor and notify Enterprise customers by email at least 30 days in advance where required by their DPA. Free and self-serve customers can subscribe to updates by emailing privacy@exeaura.ai.
3. How we vet a new subprocessor
Before engaging a subprocessor we review its security posture (SOC 2 / ISO 27001), data-protection terms, sub-processing chain, location of processing, and incident-response commitments. Contracts include a written DPA with SCCs where personal data crosses borders.
4. Data Processing Agreement
Our standard DPA is available for Enterprise customers and includes SCCs (Modules 2 and 3), transfer impact analysis language, sub-processing consent, and audit rights. Email legal@exeaura.ai to request a copy.