{
  "$schema": "https://agined.com/schemas/sub-processors/v1.json",
  "x-agined-policy": "https://agined.com/sub-processors",
  "x-agined-status": "published",
  "x-agined-note": "Agined's authoritative sub-processor inventory. Customers are notified ≥30 days before any addition; objections accepted via privacy@agined.com. Model providers are listed because Agined's own API key is used when a workspace has not supplied one; where a workspace brings its own key (BYOK) or points an agent at the LLM proxy with an inline provider key, that provider is the customer's sub-processor and not Agined's.",
  "subProcessors": [
    {
      "name": "Cloudflare, Inc.",
      "purpose": "Compute (Workers), database (D1), object storage (R2), KV cache, message queues, edge DNS, Access (zero-trust proxy).",
      "dataCategories": [
        "Customer records (ingest + audit log)",
        "Exports",
        "Operational logs"
      ],
      "processingRegions": [
        "WEUR (Frankfurt + Amsterdam)",
        "ENAM (Ashburn + San Jose)"
      ],
      "legalBasis": "GDPR Art. 28 DPA + EU SCCs Module 2; UK IDTA",
      "url": "https://www.cloudflare.com/cloudflare-customer-dpa/",
      "attestations": []
    },
    {
      "name": "Amazon Web Services, Inc.",
      "purpose": "Optional per-workspace isolated database (Aurora Serverless v2 over the RDS Data API — alternative to Cloudflare D1 at workspace creation).",
      "dataCategories": [
        "Customer records (ingest + audit log)"
      ],
      "processingRegions": [
        "Customer-selectable per workspace (26 AWS regions)"
      ],
      "legalBasis": "GDPR Art. 28 DPA (AWS GDPR DPA, incorporated into the AWS Service Terms) + EU SCCs",
      "url": "https://aws.amazon.com/compliance/gdpr-center/",
      "attestations": []
    },
    {
      "name": "Avonao Billing (operated by Avonao, Inc.)",
      "purpose": "Centralized billing entity: checkout, subscriptions, invoices, payment methods and the billing portal for every purchase of the Service, with payments processed by Stripe. Card data is entered there only.",
      "dataCategories": [
        "Billing identity",
        "Plan, status and renewal date",
        "Invoices and tax details"
      ],
      "processingRegions": [
        "US"
      ],
      "legalBasis": "GDPR Art. 28 + EU SCCs (Avonao data processing terms)",
      "url": "https://agined.com/legal/subprocessors",
      "attestations": []
    },
    {
      "name": "Stripe, Inc. / Stripe Payments Europe, Ltd.",
      "purpose": "Merchant of record and payment processor for every purchase of the Service, processed via Avonao Billing: collects the price, calculates, collects and remits tax, and pays refunds. Card data is entered at Avonao Billing checkout only.",
      "dataCategories": [
        "Billing identity",
        "Payment instrument metadata",
        "Invoices and tax details"
      ],
      "processingRegions": [
        "US (Stripe, Inc.)",
        "EU (Stripe Payments Europe)"
      ],
      "legalBasis": "GDPR Art. 28 DPA + EU SCCs (Stripe data processing agreement)",
      "url": "https://stripe.com/legal/dpa",
      "attestations": []
    },
    {
      "name": "Avonao ID (operated by Avonao, Inc.)",
      "purpose": "Sole identity provider for sign-up and sign-in (AVONAO_ID_ONLY). Third-party sign-in methods are connected at Avonao ID, not at Agined.",
      "dataCategories": [
        "Identifier, confirmed email address, name and language",
        "Subscription state sent back"
      ],
      "processingRegions": [
        "Data region chosen at Avonao ID (one of seven)"
      ],
      "legalBasis": "Independent controller for the account data it holds; claims exchanged under the Avonao agreement",
      "url": "https://agined.com/legal/subprocessors",
      "attestations": []
    },
    {
      "name": "Twilio Inc.",
      "purpose": "Text-message approvals and voice calls for severity-1 escalations, and the codes that verify a phone number (runtime/notifications/src/twilio.ts), sent from Agined's Twilio account to numbers a workspace registers.",
      "dataCategories": [
        "Phone number",
        "Message text"
      ],
      "processingRegions": [
        "US"
      ],
      "legalBasis": "GDPR Art. 28 + EU SCCs (Twilio Data Protection Addendum)",
      "url": "https://www.twilio.com/en-us/legal/data-protection-addendum",
      "attestations": []
    },
    {
      "name": "Adobe Inc. (Adobe Fonts)",
      "purpose": "Website title typeface, loaded in the EU, EEA, Switzerland and UK only after a visitor allows Fonts.",
      "dataCategories": [
        "IP address, address of the page, browser type"
      ],
      "processingRegions": [
        "US / global CDN"
      ],
      "legalBasis": "Standard Contractual Clauses",
      "url": "https://www.adobe.com/privacy/policies/adobe-fonts.html",
      "attestations": []
    },
    {
      "name": "Resend Labs Inc.",
      "purpose": "Transactional email fallback, used only when Cloudflare Email cannot deliver (billing notices, request acknowledgements, alert digests, legal-override notifications).",
      "dataCategories": [
        "Email address",
        "Email contents"
      ],
      "processingRegions": [
        "US"
      ],
      "legalBasis": "GDPR Art. 28 DPA + EU SCCs Module 2",
      "url": "https://resend.com/legal/dpa",
      "attestations": []
    },
    {
      "name": "Anthropic PBC",
      "purpose": "Model inference for Number One (primary provider), the ActionFlow conversational composer and Agined's support assistant, ticket triage and summaries. Processes the prompt and the customer content included in it.",
      "dataCategories": [
        "Conversation content",
        "Workspace configuration named in a prompt",
        "Flow descriptions",
        "Support ticket text sent to the assistant"
      ],
      "processingRegions": [
        "US"
      ],
      "legalBasis": "GDPR Art. 28 DPA + EU SCCs Module 2",
      "url": "https://www.anthropic.com/legal/commercial-terms",
      "attestations": []
    },
    {
      "name": "OpenAI, L.L.C.",
      "purpose": "Model inference as a Number One failover provider, used only when configured and when the primary is unavailable.",
      "dataCategories": [
        "Conversation content",
        "Workspace configuration named in a prompt"
      ],
      "processingRegions": [
        "US"
      ],
      "legalBasis": "GDPR Art. 28 DPA + EU SCCs Module 2",
      "url": "https://openai.com/policies/data-processing-addendum",
      "attestations": []
    },
    {
      "name": "Google LLC (Gemini API; website analytics)",
      "purpose": "Model inference as a Number One failover provider, used only when configured and when the primary is unavailable. Also website analytics (Google Analytics 4), only after a visitor allows Statistics.",
      "dataCategories": [
        "Conversation content",
        "Workspace configuration named in a prompt"
      ],
      "processingRegions": [
        "US"
      ],
      "legalBasis": "GDPR Art. 28 DPA + EU SCCs Module 2",
      "url": "https://cloud.google.com/terms/data-processing-addendum",
      "attestations": []
    },
    {
      "name": "Mistral AI SAS",
      "purpose": "Model inference as a Number One failover provider, used only when configured and when the primary is unavailable.",
      "dataCategories": [
        "Conversation content",
        "Workspace configuration named in a prompt"
      ],
      "processingRegions": [
        "EU (France)"
      ],
      "legalBasis": "GDPR Art. 28 DPA (EU-established processor; no transfer mechanism required)",
      "url": "https://mistral.ai/terms/",
      "attestations": []
    }
  ],
  "fraudDetectionProviders": "None. See /.well-known/fraud-providers.json: no third-party fraud provider processes Agined data today."
}