1. How Subprocessors Are Used
For Customer Personal Data covered by the Data Processing Addendum, exdata uses subprocessors for defined service functions only. Data shared with a subprocessor is limited to what the provider needs for that function, such as hosting infrastructure, transactional email, monitoring, support, or AI-assisted extraction.
Customer gives general authorization for listed subprocessors under the Data Processing Addendum. exdata will update this page or provide another reasonable notice channel before adding or replacing a production subprocessor that materially affects customer document processing.
The table also includes selected providers used for Company-controlled account registration, billing, and service operations where their processing roles are relevant to customers or visitors. Inclusion does not mean that every activity is performed as a subprocessor, and this page is not a general inventory of vendors used solely for the Company’s internal administration, accounting, or legal obligations.
Where exdata controls the deployment location, the processing location below describes the current production configuration. For provider-controlled services, it summarizes the applicable account configuration and the provider’s published service locations. Some providers also process limited account, support, security, billing, or operational metadata in other locations under their own data processing terms.
2. Current Providers And Subprocessors
| Provider | Purpose | Data involved | Processing location |
|---|---|---|---|
| Hetzner | Application servers, database, queue workers, self-managed Redis, and daily server backups. | Account data, uploaded documents, previews, extracted text, extracted fields, operational logs, queue metadata, support context, and backup copies of server data. | European Union: Germany (Falkenstein) for the current production infrastructure. Hetzner Cloud backups remain in the same location as the source servers. |
| Hetzner Object Storage | Object storage for uploaded source files, previews, thumbnails, and generated document artifacts. | Uploaded documents, generated previews, thumbnails, extracted text artifacts, and file metadata. | European Union: Germany (Falkenstein) for the current production object-storage bucket. |
| Amazon Web Services (AWS S3) | Database backup storage and restore support for operational recovery. | Database backup copies containing customer and account data, extracted document data and metadata, application records, and operational recovery metadata. | European Union: Ireland (AWS region eu-west-1) for the currently configured Laravel Forge database-backup storage. |
| Stripe | Checkout, payment processing, tax calculation, invoices, receipts, billing portal, and payment method handling. | Billing contact data, tax IDs, payment metadata, invoice data, transaction references, and customer portal records. | Ireland / EMEA for Stripe’s European entities. Additional Stripe subprocessors may process billing data in listed countries, including the United States and EU/UK locations. |
| Postmark | Transactional email delivery for account, authentication, billing, support, and operational messages. | Email address, recipient name, notification content, delivery status, and delivery metadata. | United States: primary Postmark data and servers are hosted outside Chicago and on AWS. Postmark does not currently offer EU-hosted servers. |
| Cloudflare, Inc. (Turnstile) | Acts as a processor on exdata’s behalf for bot and abuse prevention during account registration, including browser challenges and server-side validation of Turnstile tokens. Cloudflare separately acts as controller when it processes Turnstile signals to improve its bot-detection capabilities. | IP addresses, TLS fingerprints, user-agent and other browser signals, Turnstile site keys and associated origins, challenge tokens, and verification metadata. | For processing on exdata’s behalf: Cloudflare service locations, including possible processing in the United States and other locations outside the EEA, Switzerland, and the United Kingdom, under Cloudflare’s DPA and applicable transfer safeguards. Cloudflare’s separate controller processing is governed by its Turnstile Privacy Addendum and privacy terms. |
| OpenAI | AI-assisted document extraction, field interpretation, and normalization support. | Uploaded document content, extracted text, snippets, metadata, and prompts needed to produce extraction output. | Depends on the OpenAI API project and endpoint. Europe (EEA and Switzerland) is available for eligible API projects when data residency is enabled; otherwise processing may occur in OpenAI’s standard service locations. |
| Laravel Nightwatch | Application monitoring, error tracking, request diagnostics, alerting, and operational reliability workflows. | Request metadata, error traces, environment metadata, diagnostic logs, account identifiers, and incident context. | European Union when the Nightwatch EU data storage region is configured. Monitoring metadata may also be processed under Laravel’s provider and subprocessor terms. |
3. Objections And Questions
Customers may object to a new or replacement subprocessor on reasonable data protection grounds. Send questions or objections to privacy@exdata.app and include the customer account, affected service area, and the reason for the objection.
4. Related Documents
Review the Data Processing Addendum, Technical and Organizational Measures, and Privacy Policy for the broader processing terms.