← Back to home

Sub-processors

Last updated: September 23, 2026

1. Overview

Transformics engages a small, audited set of sub-processors to operate the Service. Each sub-processor is bound by a written agreement imposing data-protection obligations no less protective than those in our Data Processing Agreement (DPA). The table below is kept current; a material change triggers the 30-day Customer notice described below.

The authoritative list is rendered directly from our internal source of truth at frontend/lib/subprocessors.ts, when the code changes, this page changes.

2. Current sub-processors

Sub-processorPurposeRegionTransfer mechanism
Supabase
Supabase Inc.
Legal/privacy →		Database, authentication, file storage
  • Account data
  • Customer Data (respondents, responses, scores)
  • Generated reports
EU
Germany (AWS eu-central-1, Frankfurt)
EU SCCs Module 2 (2021/914)
Anthropic
Anthropic PBC
Legal/privacy →		Provider of the Claude models used for scoring, report generation and agent features. Transformics does not call Anthropic directly: the models are served through AWS Bedrock (see below).
  • No data sent to Anthropic directly by Transformics (all requests go to AWS Bedrock)
US
United States (company); models invoked through AWS Bedrock in AWS EU Regions
Under legal review for Bedrock-only routing
AWS Bedrock
Amazon Web Services EMEA SARL
Legal/privacy →		Large-language-model inference (Anthropic Claude models) for all Customers, through EU cross-region inference profiles
  • Prompts containing assessment context
  • Model outputs
EU
EU: requests from eu-west-1 (Ireland), routed only to AWS Regions in EU member states
Processing Regions are in the EU; provider data handling (retention, training use) under legal review
Stripe
Stripe Payments Europe, Limited
Legal/privacy →		Subscription billing and payment processing
  • Billing contact name and email
  • Payment method metadata
  • Invoice records
Global
Ireland (EU HQ); processing may occur in US
EU SCCs Module 2 (2021/914); Stripe-issued DPA
Resend
Resend Inc.
Legal/privacy →		Transactional email delivery (survey invitations, reminders, system notifications)
  • Recipient email addresses and names
  • Email subject and rendered body (links, organization name, deadlines)
US
United States
EU SCCs Module 2 (2021/914)
Typeform
TYPEFORM S.L.
Legal/privacy →		Optional survey-import integration (organization-level survey content only; respondent PII not transmitted)
  • Survey content (questions, metadata)
EU
Spain
Within EEA — no international transfer
Apollo.io
Apollo.io Inc.
Legal/privacy →		Company-level data enrichment (organization attributes only; no personal data)
  • Company name, domain, size, sector
US
United States
EU SCCs Module 2 (2021/914)
Vercel
Vercel Inc.
Legal/privacy →		Frontend hosting and edge delivery (web application + static assets)
  • Request metadata (IP address, user agent) for short-lived access logs only — not retained in application DB
Global
United States (company); hosting region not yet published
EU SCCs Module 2 (2021/914)

3. Notice of changes

Where a sub-processor is added, removed, or replaced, Transformics notifies active Customers at least 30 days in advance (via email to the account's administrative contact and an update to this page). Customers with reasonable objections may raise them through the dispute-resolution process in the DPA; where no resolution is reached, the Customer may terminate the affected Services without penalty.

Financial Entity Customers under DORA receive the same 30-day notice as a contractual commitment in Section 6.2 of the DORA Financial-Sector Rider.

4. Contact

Questions about sub-processors, transfer mechanisms, or our sub-processor risk-assessment process: privacy@transformics.ai.