Subprocessor Notice
Version 1.0-RC2 · Effective date: 12 november 2026
This document is available in English, German, French and Turkish. The English version is shown.
Draft — company registration details are being completed. This document is not yet final.
The following providers may support Govexa. The providers actually used may vary by plan, region and configuration. A provider's listing does not mean that it receives all Customer Data.
| Provider | Status | Purpose | Note | Verified region (8 November 2026) |
|---|---|---|---|---|
| Anthropic | Active / default for Govexa-managed AI | AI inference | Subprocessor for Govexa-managed use. Processing in the US and internationally may occur. ZDR is not promised unless separately verified. | US |
| OpenAI | Conditional | Optional AI inference | Subprocessor only for tenants with Govexa-managed OpenAI enabled. | US |
| Customer's Anthropic/OpenAI account | Customer-directed | BYOAI | If it is Customer's own account/API key, it is not considered a Govexa subprocessor; it is Customer's supplier. | Per Customer configuration |
| Customer's Ollama server | Customer-directed / self-hosted | BYOAI | Customer's server; under Customer's control. | Per Customer configuration |
| Vercel | Infrastructure | Web/application/functions | No EU-only claim is made unless the EU function region is verified. | Functions: EU — Frankfurt (fra1) |
| Railway | Infrastructure | Backend/PostgreSQL/compute | No EU-only claim is made unless the actual deployment region is verified. | EU — Amsterdam (europe-west4) |
| Cloudflare | Infrastructure/security | DNS/CDN/WAF/DDoS; R2 file storage | R2 EU jurisdiction / Regional Services are committed only if actually configured. | R2: EU jurisdiction; network: global |
| Sentry | Conditional | Error monitoring | Only if the production integration is enabled. PII-reduction controls in place. | Being verified |
| Paddle | Merchant of Record / separate role + necessary processing | Payment, tax, invoicing, refunds | Paddle's own legal role and terms also apply. | United Kingdom |
| Lemon Squeezy | Conditional — backup Merchant of Record | Payment, tax, invoicing, refunds | Only if Paddle becomes unavailable and it is activated. | US |
| ZeptoMail (Zoho) | E-mail service | Transactional e-mail | EU cluster per current verification; the list is updated if the actual account/cluster changes. Open/click tracking disabled. | EU cluster |
Source systems connected by the customer such as AWS, Google, Okta, Microsoft Entra, GitHub, Jira and Slack are integration sources from which Govexa pulls data on Customer's behalf. These services, which are Customer's direct suppliers, are not automatically Govexa subprocessors merely because a Govexa connector exists. If Govexa separately uses a service with its own account, its role is assessed separately.
The "Verified region" column reflects the technical verification on the stated date; it is not an EU-only service commitment unless separately committed in writing.