Subprocessor register
The processors that handle information for us.
This register lists organizations that process personal data or client content on Xpancom's behalf. It does not list every internal tool that never receives that content.
01 / Section
Current subprocessors.
We will give at least 30 days' notice of a material addition, except for an emergency security substitution. Object under the Data Processing Addendum if you have reasonable data-protection grounds.
| Processor | Purpose | Data classes | Location | Last reviewed |
|---|---|---|---|---|
| Neon | PostgreSQL for inquiries, intake, authentication, and the invitation-only workspace | Contact details, intake answers, account identity, workspace records, security logs | United States | 15 September 2026 |
| Vercel | Hosting, TLS, and edge delivery for the marketing site, workspace, auth, and admin | Request metadata, application code, environment configuration | United States, with a global edge network | 15 September 2026 |
| Twilio SendGrid | Transactional email (magic links, invitations, intake links, operator notifications) | Email address and the contents of the transactional message | United States | 15 September 2026 |
| Twilio | SMS one-time sign-in codes when SMS is enabled for an invited person | Mobile number and the one-time code | United States | 15 September 2026 |
02 / Section
What is not on this list.
Governance platforms used only for Xpancom's own control evidence, if they do not receive client content, are not subprocessors of client data. Client-owned systems we access read-only during discovery remain the client's processors, not ours. Unused hostnames such as partners or training subdomains are not operational.