1. How Subprocessors Are Used
For Customer Personal Data covered by the Data Processing Addendum, exdata uses subprocessors for defined service functions only. Data shared with a subprocessor is limited to what the provider needs for that function, such as hosting infrastructure, transactional email, monitoring, support, AI-assisted extraction, or a separately instructed temporary quality diagnosis.
Customer gives general authorization for listed subprocessors under the Data Processing Addendum. exdata will update this page or provide another reasonable notice channel before adding or replacing a production subprocessor that materially affects customer document processing.
The table also includes selected providers used for account registration, advertising measurement, billing, and service delivery where their processing roles are relevant to customers or visitors. Inclusion does not mean that every activity is performed as a subprocessor; the listed purposes and locations identify the customer-relevant processing described here.
For exdata-hosted services, the processing location below describes the production service region. For provider-hosted services, it summarizes the provider’s published service locations. Some providers may process limited account, support, security, billing, or service metadata in other locations under their own data processing terms.
2. Current Providers And Subprocessors
| Provider | Purpose | Data involved | Processing location |
|---|---|---|---|
| Hetzner | Hosted application, database, processing, storage, and backup services. | Account data, uploaded documents, previews, extracted text, extracted fields, service records, support context, and backup copies. | European Union: Germany (Falkenstein) for the current production infrastructure. Hetzner Cloud backups remain in the same location as the source servers. |
| Hetzner Object Storage | Object storage for uploaded source files, previews, thumbnails, and generated document artifacts. | Uploaded documents, generated previews, thumbnails, extracted text artifacts, and file metadata. | European Union: Germany (Falkenstein) for the current production object-storage bucket. |
| Amazon Web Services (AWS S3) | Database backup storage and recovery support. | Database backup copies containing customer and account data, extracted document data and metadata, application records, and recovery metadata. | European Union: Ireland (AWS region eu-west-1). |
| Stripe | Checkout, payment processing, tax calculation, invoices, receipts, billing portal, and payment method handling. | Billing contact data, tax IDs, payment metadata, invoice data, transaction references, and customer portal records. | Ireland / EMEA for Stripe’s European entities. Additional Stripe subprocessors may process billing data in listed countries, including the United States and EU/UK locations. |
| Postmark | Transactional email delivery for account, authentication, billing, support, and service messages. | Email address, recipient name, notification content, delivery status, and delivery metadata. | United States: primary Postmark data and servers are hosted outside Chicago and on AWS. Postmark does not currently offer EU-hosted servers. |
| Cloudflare, Inc. (Turnstile) | Acts as a processor on exdata’s behalf for bot and abuse prevention during account registration, including browser challenges and validation of Turnstile tokens by the service. Cloudflare separately acts as controller when it processes Turnstile signals to improve its bot-detection capabilities. | IP addresses, TLS fingerprints, user-agent and other browser signals, Turnstile site keys and associated origins, challenge tokens, and verification metadata. | For processing on exdata’s behalf: Cloudflare service locations, including possible processing in the United States and other locations outside the EEA, Switzerland, and the United Kingdom, under Cloudflare’s DPA and applicable transfer safeguards. Cloudflare’s separate controller processing is governed by its Turnstile Privacy Addendum and privacy terms. |
| OpenAI | AI-assisted document extraction, field interpretation, normalization support, and separately instructed temporary diagnosis of extraction problems. | Uploaded or separately approved temporary document content, extracted text, snippets, metadata, and processing inputs needed for extraction or quality diagnosis. | Depends on the OpenAI API project and endpoint. Europe (EEA and Switzerland) is available for eligible API projects when data residency is enabled; otherwise processing may occur in OpenAI’s standard service locations. |
| Laravel Nightwatch | Application monitoring, error tracking, request diagnostics, and service reliability. | Request metadata, error traces, environment metadata, diagnostic logs, account identifiers, and incident context. | European Union when the Nightwatch EU data storage region is selected. Monitoring metadata may also be processed under Laravel’s provider and subprocessor terms. |
3. Objections And Questions
Customers may object to a new or replacement subprocessor on reasonable data protection grounds. Send questions or objections to privacy@exdata.app and include the customer account, affected service area, and the reason for the objection.
4. Related Documents
Review the Data Processing Addendum, Technical and Organizational Measures, and Privacy Policy for the broader processing terms.