Subprocessor List
Effective Date: July 1, 2026
Last Updated: July 1, 2026
Version: en-US 2026-07-01
Contact: [email protected]
This Subprocessor List identifies third-party service providers that Txaion currently authorizes to process Customer Personal Data in connection with the Services. This list supports the Data Processing Addendum and is incorporated into the Terms of Service.
Actual subprocessors may vary depending on product, plan, region, feature configuration, integrations enabled by Customer, and operational needs. Core subprocessors are generally used to operate the Services. Feature-optional subprocessors process Customer Personal Data only when the relevant feature, integration, payment method, login method, workflow, or support channel is enabled or used.
A provider listed below is authorized to process Customer Personal Data only to the extent Txaion actually uses that provider for the Services, the Customer enables the relevant feature or integration, or the provider is reasonably necessary for support, security, billing, compliance, or service delivery. Listing a provider does not mean every Customer uses that provider or that every category of Customer Personal Data is sent to that provider.
Before authorizing a subprocessor to process Customer Personal Data, Txaion enters into written data protection terms designed to require the subprocessor to process Customer Personal Data only for the authorized purpose, protect Customer Personal Data with appropriate safeguards, maintain confidentiality obligations, assist with required privacy and security obligations where applicable, and restrict unauthorized sale, sharing, or model training. Txaion provides notice and objection rights for new subprocessors as described in the DPA.
For clarity:
- "Customer Content" means prompts, files, text, images, audio, video, voice samples, digital twin materials, datasets, messages, outputs, and other content submitted to or generated through the Services by or for Customer.
- "Required" means the provider is generally necessary for the hosted Services, billing, security, or core operations.
- "Optional" means the provider processes Customer Personal Data only if the Customer enables or uses the related feature, integration, payment method, workflow, or support channel.
- "Customer Content?" indicates whether Customer Content may be processed by that provider for the listed purpose. It does not mean all Customer Content is sent to that provider.
- "AI/model training" identifies whether Txaion authorizes the provider to use Customer Personal Data for provider model training. Unless expressly authorized by Customer in writing or through a product setting made available for that purpose, Txaion does not authorize subprocessors to use Customer Personal Data to train, fine-tune, or improve third-party foundation models or Txaion general-purpose AI models.
1. Core Infrastructure and Business Operations Subprocessors
| Subprocessor | Service / feature | Required or optional | Customer Personal Data processed | Customer Content? | Processing locations | AI/model training | Customer control | Provider information |
|---|---|---|---|---|---|---|---|---|
| Cloudflare, Inc. | CDN, DNS, security, WAF, DDoS protection, edge delivery, and object storage where enabled | Required for edge delivery and security; object storage is feature-dependent | IP addresses, device data, request metadata, security logs, and limited Customer Content if routed through edge delivery or stored through enabled object-storage features | Yes, only as routed or stored for the enabled service | United States and global | No | Core security and delivery cannot generally be disabled for hosted Services; optional storage features may be disabled by not using them | Cloudflare Trust Center |
| Akamai Technologies, Inc. / Linode | Cloud hosting, compute, storage, networking, and infrastructure | Required for hosted Services where Txaion deploys on Linode infrastructure | Customer Content, account data, usage data, logs, metadata, and infrastructure data | Yes | United States, Japan, and other available regions selected or supported for the Services | No | Required for hosted Services using this infrastructure | Akamai Trust Center and Linode Security |
| Google LLC | Google Workspace, email, productivity, internal operations, and limited support workflows where used | Required for selected business operations; support use is request-dependent | Business contact data, account contact data, support communications, operational metadata, and limited Customer Content if submitted through support, email, documents, or operational workflows | Limited; only if Customer or Txaion personnel include Customer Content in support or operational workflows | United States and global | No | Customers can reduce exposure by avoiding Customer Content in support tickets or email unless needed for support | Google Cloud Trust Center and Google Workspace Security |
| Stripe, Inc. | Payment processing, billing, tax, fraud prevention, invoice management, and subscription management for paid plans | Required for paid plans processed through Stripe | Billing data, transaction data, account contact data, tax data, payment metadata, and fraud-prevention signals | No, except incidental references in billing notes or support communications | United States and global | No | Required for paid plans processed through Stripe; Customers using an alternate payment method may not use Stripe | Stripe Privacy Center and Stripe Security |
2. AI and Feature-Optional Subprocessors
The following providers may process Customer Personal Data only if Customer enables or uses the related AI feature, model provider, payment method, login method, workflow, communication channel, support process, or integration. Txaion uses contractual, technical, account-level, or configuration controls available for the applicable provider to restrict unauthorized provider model training.
| Subprocessor | Service / feature | Required or optional | Customer Personal Data processed | Customer Content? | Processing locations | AI/model training | Customer control | Provider information |
|---|---|---|---|---|---|---|---|---|
| OpenAI, L.L.C. | AI inference, embeddings, language, vision, speech, safety, and related model services where enabled | Optional; used only for enabled AI features, selected model routes, or related safety processing | Prompts, Customer Content, files, metadata, outputs, audio, images, and related AI request data submitted to enabled AI features | Yes, only for enabled AI features routed to OpenAI | United States and global | No, unless Customer expressly authorizes training or model-improvement use | Customer may avoid use by disabling or not selecting features routed to OpenAI where alternatives are available | OpenAI Privacy and OpenAI Security |
| Anthropic, PBC | AI inference and model services where enabled | Optional; used only for enabled AI features or selected model routes | Prompts, Customer Content, metadata, outputs, and related AI request data submitted to enabled AI features | Yes, only for enabled AI features routed to Anthropic | United States and global | No, unless Customer expressly authorizes training or model-improvement use | Customer may avoid use by disabling or not selecting features routed to Anthropic where alternatives are available | Anthropic Privacy and Anthropic Trust Center |
| Google LLC | Google Cloud, AI, translation, speech, identity, analytics, email, productivity, and integration services where enabled | Optional for AI, cloud, identity, analytics, and integration features; required only where the selected Service configuration depends on Google services | Account data, authentication data, Customer Content, usage data, logs, metadata, integration data, audio, images, and AI request data depending on the enabled feature | Yes, only for enabled features or workflows that route Customer Content to Google services | United States and global | No, unless Customer expressly authorizes training or model-improvement use | Customer may avoid use by disabling or not selecting Google-backed AI, analytics, identity, or integration features where alternatives are available | Google Cloud Trust Center and Google Privacy |
| PayPal, Inc. | Payment processing where enabled | Optional; used only if Customer selects or is offered PayPal payment processing | Billing data, transaction data, account contact data, payment metadata, and fraud-prevention signals | No, except incidental references in billing notes or support communications | United States and global | No | Customer may use another supported payment method where available | PayPal Privacy |
| Twilio Inc. | Email, SMS, messaging, voice, verification, and communications where enabled | Optional; used only for enabled messaging, notification, verification, or voice communication features | Contact data, phone numbers, email addresses, message content, voice communication data, delivery metadata, and verification metadata | Limited; only message or voice content submitted to enabled communication features | United States and global | No | Customer may disable optional messaging, voice, or verification workflows where available | Twilio Trust Center |
| GitHub, Inc. | Source control, issue tracking, documentation, deployment support, and legal document hosting where enabled | Optional; used only for development, documentation, support, issue tracking, or repository workflows | Business contact data, support metadata, repository content, issue content, documentation metadata, and limited Customer Content if submitted through repositories, issues, or support workflows | Limited; only if Customer or Txaion personnel submit Customer Content to GitHub workflows | United States and global | No | Customer should not submit Customer Content to GitHub issues or repositories unless needed for support or collaboration | GitHub Privacy and GitHub Security |
3. Integration-Optional Subprocessors
These providers process Customer Personal Data only if Customer or its users enable, connect, authenticate, or use the relevant integration. Customer is responsible for configuring connected third-party accounts, authorizations, scopes, permissions, and data flows.
| Subprocessor | Service / feature | Required or optional | Customer Personal Data processed | Customer Content? | Processing locations | AI/model training | Customer control | Provider information |
|---|---|---|---|---|---|---|---|---|
| Apple Inc. | Apple sign-in, app distribution, payments, or Apple platform integrations | Optional; used only if Customer or user selects Apple-backed features | Account data, authentication data, transaction metadata, device or platform metadata | No, except content submitted through an Apple-enabled feature or platform workflow | United States and global | No | Customer or user may avoid use by not selecting Apple sign-in, app store payments, or Apple integrations | Apple Privacy |
| Microsoft Corporation | Microsoft login, Microsoft cloud, Teams, Outlook, productivity, or enterprise integrations | Optional; used only if Customer enables Microsoft-backed identity, cloud, collaboration, or productivity integrations | Account data, authentication data, Customer Content, integration data, files, messages, calendar data, emails, and metadata depending on Customer configuration | Yes, only for enabled Microsoft integrations and selected scopes | United States and global | No, unless Customer separately authorizes Microsoft AI/model-improvement use through the relevant Microsoft service | Customer may disconnect Microsoft integrations or limit scopes where available | Microsoft Privacy and Microsoft Trust Center |
| Slack Technologies, LLC | Slack notifications and workspace integrations | Optional; used only if Customer enables Slack integration | Account data, workspace identifiers, channel identifiers, messages, notification content, and delivery metadata | Limited; only content sent to or received from enabled Slack workflows | United States and global | No | Customer may disconnect Slack integration or limit channels and scopes where available | Slack Privacy and Slack Trust Center |
| Zapier, Inc. | Workflow automation integrations | Optional; used only if Customer enables Zapier workflows | Customer-selected integration data, workflow payloads, account data, metadata, and content selected by Customer for automation | Yes, only content Customer routes through enabled Zapier workflows | United States and global | No | Customer may disable Zapier workflows or limit connected app scopes where available | Zapier Privacy and Zapier Security |
4. Affiliates, Contractors, and Professional Providers
Txaion may use affiliates, independent contractors, legal counsel, accountants, auditors, insurers, security consultants, and professional advisors to support operations. These parties process Customer Personal Data only as necessary and under confidentiality or professional obligations.
5. Subprocessor Updates
Txaion may add, replace, or remove subprocessors.
Where required by the DPA or applicable law, Txaion will provide reasonable notice of material new subprocessors, or other subprocessor changes for which notice is legally required, before they process Customer Personal Data, unless urgent security, operational, legal, continuity, infrastructure, support, service-delivery, or feature-availability reasons require shorter notice or immediate deployment.
Notice may be provided through any reasonable method, including email, in-product notice, website posting, release notes, a subscription-based update list, or updates to this list. Not all notices will be provided individually to every Customer unless required by applicable law or a written agreement.
Updates that do not materially expand the categories of Customer Personal Data processed or materially increase privacy, security, or compliance risk may be reflected in this list without separate advance notice, unless applicable law or a written agreement requires otherwise.
Customers may object on reasonable data protection grounds according to the DPA. An objection should identify the specific subprocessor, the affected Service, and the reasonable data protection basis for the objection. Txaion will use commercially reasonable efforts to address the objection, which may include additional information, safeguards, configuration options, an alternative subprocessor where reasonably available, or termination of the affected Service as described in the DPA.
Customers are responsible for keeping account, billing, legal, and privacy contact information current so they can receive notices.
Change History
| Date | Change |
|---|---|
| July 1, 2026 | Initial en-US subprocessor list. |
6. Customer-Enabled Third-Party Services
If Customer connects the Services to a third-party service, that third party may process data as an independent controller or processor under its own terms and privacy policy. Customer is responsible for reviewing and approving customer-enabled integrations.
7. Data Transfer Safeguards
Where required, Txaion uses data processing agreements, Standard Contractual Clauses, UK transfer addenda, confidentiality obligations, security reviews, and other appropriate safeguards with subprocessors. For AI model providers and feature-optional subprocessors, Txaion uses available contractual, technical, or configuration controls designed to prevent Customer Personal Data from being used for model training unless Customer authorizes that use.
Txaion reviews subprocessor information periodically and may update provider names, purposes, locations, links, controls, and feature descriptions to reflect changes in the Services, provider documentation, applicable law, and operational use.