Legal · subprocessors
Two subprocessors.
A subprocessor is a third party that processes customer data on our behalf. This page is the current list, and it is the notice mechanism the Data Processing Addendum refers to. It is short because the platform is deliberately built on very little: one cloud provider, one region, one mailbox, and nothing else in the path of your data.
Last updated · 2026-09-18 Two subprocessors All platform processing in us-east-1
The
list
Amazon Web Services, and the mailbox the mail lands in.
The AWS services are all in us-east-1 (Northern Virginia, United States), and AWS is responsible for the physical and environmental security of that infrastructure. Microsoft is on the list for one thing only: it runs hello@superiora.ai, which is where mail to us — including a demo request from the form on /demo/ — is delivered and kept.
| Subprocessor | What it does | Data it touches | Location |
|---|---|---|---|
| Amazon Web Services — EC2 | The compute the platform runs on: the control plane, each model’s engine process, and its data volume. | All customer data. | us-east-1 |
| Amazon Web Services — S3 | Nightly backup of the data volume, and the staging bucket the website is deployed from. | Backups of all customer data; no personal data on the website side. | us-east-1 |
| Amazon Web Services — SES | Outbound mail: the platform's invitations, password and notification messages — and the one message a demo request from the form on /demo/ becomes. | Recipient name and email address, and the contents of the notification. For a demo request: the name, work email, company, process and message the sender typed, in transit only — SES stores none of it. | us-east-1 |
| Amazon Web Services — ECR | The private registry holding the application image that the host runs. | No customer data. Our software only. | us-east-1 |
| Microsoft 365 — Exchange Online | The mailbox the founding team reads, hello@superiora.ai. Every message sent to us — a demo request, a support mail, a privacy request — is delivered here and kept here. It is a correspondence mailbox, not part of the platform. |
Correspondence: the sender’s name and address and whatever the message says. No model, cell or account data is ever sent to it. | [Owner: Microsoft 365 tenant data region] |
What is
not on it
Three things people expect to find here and will not.
- No AI model provider. No customer data is sent to a third-party model API by the platform. Forecasting runs in a sidecar alongside the engine, on the same host. Where an AI agent builds or changes a model, that agent is run by the customer or by us as an operator, against the platform’s own authenticated interface — so the model provider is the agent operator’s choice and their responsibility, not a subprocessor of ours.
- No analytics or product-telemetry vendor. Nothing reports what you clicked to anyone.
- No CRM, support-desk or chat vendor in the data path. Support during the pilot runs over mail to the founding team.
Apart from the form, whose endpoint is our own function on the AWS above, the one third party the website touches is Google Fonts, which serves the typefaces and therefore sees a reader’s IP address. It processes no customer data and is not a subprocessor; it is disclosed on cookies and privacy because it is a request your browser makes.
Changes
How you hear about a new one.
Adding a subprocessor that touches customer data means updating this page and notifying the administrator contact on each account at least [Owner: subprocessor change notice period, e.g. 30 days] before the change takes effect. A customer who objects on reasonable data-protection grounds may raise it with us, and the escalation path is in the signed DPA.
To be told directly rather than by watching this page, write to hello@superiora.ai and ask to be on the subprocessor notice list.