Subprocessor register
Subprocessors
The processors that handle information for us.
This register lists organizations that process personal data or client content on Xpancom's behalf. It does not list every internal tool that never receives that content.
01 / Section
Current subprocessors.
We will give at least 30 days' notice of a material addition, except for an emergency security substitution. Object under the Data Processing Addendum if you have reasonable data-protection grounds.
| Processor | Purpose | Data classes | Location | Last reviewed |
|---|---|---|---|---|
| Neon | PostgreSQL for inquiries, intake, authentication, and the invitation-only workspace | Contact details, intake answers, account identity, workspace records, security logs | United States | 16 September 2026 |
| Vercel | Hosting, TLS, and edge delivery for the marketing site, workspace, auth, and admin; durable workflow execution and private object storage for internal prospect research | Request metadata, application code, environment configuration, workflow step records, stored page snapshots and generated documents | United States, with a global edge network | 16 September 2026 |
| OpenAI | Language-model calls for internal prospect pre-screen research, sent to OpenAI Chat Completions. These requests are not covered by a zero-data-retention agreement and are recorded as such on each run. | Excerpts of public web pages and Xpancom-authored analysis prompts. No client records. | United States | 16 September 2026 |
| Twilio SendGrid | Transactional email (magic links, invitations, intake links, operator notifications) | Email address and the contents of the transactional message | United States | 16 September 2026 |
| Twilio | SMS one-time sign-in codes when SMS is enabled for an invited person | Mobile number and the one-time code | United States | 16 September 2026 |
02 / Section
What is not on this list.
Governance platforms used only for Xpancom's own control evidence, if they do not receive client content, are not subprocessors of client data. Client-owned systems we access read-only during discovery remain the client's processors, not ours. Unused hostnames such as partners or training subdomains are not operational.