Sub-Processor Authorization & Management
Nexus AI Coding maintains a comprehensive list of all authorized sub-processors (third-party service providers) that process personal data on behalf of customers. All sub-processors are contractually bound by Data Processing Agreements (DPAs) requiring equivalent GDPR and CCPA compliance.
Authorized Sub-Processors by Category
💳 Payment Processing
Data Processed: Payment method, billing address, transaction details
Purpose: Payment processing, billing, subscription management, refunds
Location: USA, Multi-regional
DPA Status: ✓ Executed
🏗️ Infrastructure & Hosting
Data Processed: All personal data (hosting)
Purpose: Cloud infrastructure, data storage, backups, CDN
Location: USA, EU, Asia Pacific
DPA Status: ✓ Executed
📊 Analytics & Monitoring
Data Processed: Usage data, behavioral analytics, error logs
Purpose: Platform analytics, performance monitoring, error tracking
Location: USA, EU
DPA Status: ✓ Executed
💬 Support & Communications
Data Processed: Support tickets, email, communications
Purpose: Customer support, email delivery, communication services
Location: USA
DPA Status: ✓ Executed
🔐 Security & Compliance
Data Processed: IP addresses, access logs, request metadata
Purpose: DDoS protection, identity management, compliance monitoring
Location: USA, EU
DPA Status: ✓ Executed
Detailed Sub-Processor Registry
Payment Processing
| Sub-Processor | Location | Data Categories | Purpose | DPA Status |
|---|---|---|---|---|
| Stripe | USA | Payment method, billing address, transaction ID | Payment processing, billing, subscriptions | Executed |
| PayPal | USA, Ireland | Payment method, billing address, transaction ID | Payment processing, refunds | Executed |
| Authorize.Net | USA | Payment method, billing address, transaction details | Payment gateway services | Executed |
| Paddle | UK, USA | Payment method, billing, transaction details | Global commerce and payment processing | Executed |
| Whop | USA | Payment method, billing, transaction ID | Marketplace integration, payment processing | Executed |
Infrastructure & Hosting
| Sub-Processor | Location | Data Categories | Purpose | DPA Status |
|---|---|---|---|---|
| Amazon Web Services (AWS) | USA, EU, Asia Pacific | All personal data (hosting) | Cloud infrastructure, data storage, backups | Executed (DPA) |
| Google Cloud Platform (GCP) | USA, EU, Asia Pacific | Backup data, analytics data | Cloud services, backup infrastructure | Executed (DPA) |
| Microsoft Azure | USA, EU | Backup data, infrastructure logs | Cloud hosting, infrastructure services | Executed (DPA) |
Analytics & Monitoring
| Sub-Processor | Location | Data Categories | Purpose | DPA Status |
|---|---|---|---|---|
| Google Analytics | USA, EU | Usage data, behavioral analytics, IP | Website analytics, user behavior tracking | Executed |
| Amplitude | USA | Product analytics, event data | Product analytics, event tracking | Executed |
| Sentry | USA, Germany | Error logs, stack traces, request metadata | Error tracking, performance monitoring | Executed |
| New Relic | USA | Application performance data, logs | Application performance monitoring | Executed |
Support & Communications
| Sub-Processor | Location | Data Categories | Purpose | DPA Status |
|---|---|---|---|---|
| Zendesk | USA, Ireland | Support tickets, user information, emails | Customer support ticketing, communication | Executed |
| SendGrid | USA | Email addresses, email content | Email delivery, transactional emails | Executed |
| Twilio | USA | Phone numbers, SMS/communication data | SMS and communication services | Executed |
Security & Compliance
| Sub-Processor | Location | Data Categories | Purpose | DPA Status |
|---|---|---|---|---|
| Cloudflare | USA, EU | IP addresses, request logs, metadata | DDoS protection, security, CDN | Executed |
| Okta | USA | User authentication, access logs | Identity management, access control | Executed |
| Vanta | USA | Compliance data, audit logs, certifications | Compliance monitoring, documentation | Executed |
Sub-Processor Notification & Objection Procedures
New Sub-Processor Identified
Nexus AI identifies new sub-processor need for service delivery or improvement
30-Day Advance Notice
Customers notified via email with sub-processor name, location, and data access scope
15-Day Objection Window
Customers may submit written objection to: [email protected]
Good-Faith Resolution
Nexus AI discusses objections in good faith with customer
Termination Option
If unresolved, either party may terminate without penalty
Sub-Processor DPA
All approved sub-processors execute DPA with GDPR/CCPA compliance requirements
Objection Process
How to Object: Email [email protected] with:
- Subject: "Sub-Processor Objection"
- Sub-processor name and specific concerns
- Business or privacy impact justification
- Requested alternative (if applicable)
Response Timeline: Nexus AI will respond within 10 business days to discuss objection.
Resolution Options:
- ✓ Sub-processor approved as proposed
- ✓ Alternative sub-processor identified and agreed upon
- ✓ Enhanced data handling procedures implemented
- ✓ Service agreement modified or terminated without penalty
Sub-Processor DPA Requirements
All sub-processors listed above are contractually required to:
Compliance Obligations
- GDPR Article 28 Compliance: Process personal data only per instructions, implement security measures, assist with data subject rights
- CCPA Service Provider Requirements: Use data only to provide services, not sell personal information, implement data security
- Sub-processor Management: Notify of any further sub-contractors, ensure they comply with equivalent terms
- Data Subject Rights: Cooperate with requests for access, deletion, correction, portability
- Breach Notification: Notify Nexus AI within 24 hours of any suspected data breach
- Data Return/Deletion: Return or securely delete personal data upon contract termination
Security Requirements
- Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
- Access controls: RBAC, MFA, principle of least privilege
- Security monitoring: Intrusion detection, vulnerability scanning
- Regular audits: SOC 2, ISO 27001, or equivalent certifications
- Incident response procedures with 24-hour notification requirement
- Employee confidentiality agreements and data protection training
Request Sub-Processor Information
For copies of sub-processor DPAs, audit reports, or compliance certifications:
Email: [email protected]
Subject Line: "Sub-Processor Information Request"
Response Time: Within 5 business days
Related Legal Documents & Information
For additional information about data processing, privacy, and compliance:
📋 Terms of Service
🔒 Privacy Policy
💰 Refund Policy
📄 EULA
🔐 Data Processing Agreement
📞 Contact Us