This page lists the sub-processors the Platform may use to process Customer Data, with their purpose and location. We give at least 30 days' notice within the Platform, or by email, before adding or replacing a sub-processor, and Customer may object as described in Section 4 of the DPA. Locations are as stated below unless otherwise agreed in an Order.
| Sub-processor | Purpose | Data | Location | Certifications |
|---|---|---|---|---|
| Google Cloud — Vertex AI | AI model inference (document analysis) | Customer Data, Outputs | Global endpoint: processing may occur in any country where the provider operates | ISO 27001 / 27017 / 27018, SOC 2 |
| Amazon Web Services (AWS) | Application hosting and database | Customer Data, Outputs, account data | Israel (il-central-1) | ISO 27001 / 27017 / 27018, SOC 2 |
| Google Cloud Platform | Document storage during processing | Customer Data | Israel (me-west1) | ISO 27001 / 27017 / 27018, SOC 2 |
| Amazon Web Services (AWS) — Amplify / CloudFront | Delivery of the web application's static files | No Customer Data; connection data such as IP address only | Germany (eu-central-1) and global edge locations | ISO 27001 / 27017 / 27018, SOC 2 |