Sub-processors — version 1.24
In effect from 2026-10-26. Supersedes version 1.23. Previous versions remain available at/legal/subprocessors/versions/.
Sub-processors
Version 1.24 · In effect from 26 October 2026 · supersedes 1.23
Aporta Systems, LLC uses the providers below to deliver the Service and to run this website. Each is engaged under a written data processing agreement, and we remain responsible to our customers for what each of them does.
We give customers at least thirty days’ notice before we add or replace a provider, or materially extend what one does for the Service, and a right to object on reasonable data protection grounds.
| Provider | Purpose | Data it can reach | Location |
|---|---|---|---|
| Cloudflare, Inc. | Edge compute; audit record storage; DNS and email routing; cookieless analytics on this website and the Aporta dashboard; storing this website’s beta sign-ups | Prompt text, and text extracted from attached files, unencrypted at the edge while detection runs, including the values detection then replaces with tokens. Detected values, unencrypted at the edge where the Service restores them into an AI tool’s reply while Aporta holds the vault key; after a Super User takes custody of the key, token mappings pass through the edge only sealed and are opened in the browser. The audit payload, unencrypted at the edge until it is sealed there, and opened there again when an authorized user queries or exports the record; it carries tokens in place of detected values. A file submitted for attachment review is the unscanned original: it is received unencrypted at the edge, stored sealed for up to 72 hours, and opened at the edge for the approver. Aporta Chat conversations, tokenized, opened at the edge to send them to Google and to show them to the person who owns them. Tokenized copies of attached files, where the customer keeps them, stored sealed with the audit record. Tokenized content in transit; encrypted audit records. Aggregate analytics only, with no cookie or visitor identifier. Beta sign-ups: full name, work email, business name, role, free text about how the team uses AI, and arrival time, but not the network address; deleted automatically one year after submission | United States for storage. Edge processing runs at the location nearest the user, including outside the United States, and is not stored there |
| Modal Labs, Inc. | Second-tier detection | Prompt text and extracted attachment text, unencrypted, during detection. Processed in memory, and our code does not store it. A request larger than 2 MiB passes through Modal’s central storage in the United States instead of staying in memory, and nothing yet limits how large a request can be. If detection fails, Modal’s log records the kind of error, not the text. Part of the Service; a customer cannot turn it off | United States |
| Turso (ChiselStrike, Inc.) | Per-customer vault and metadata databases | Encrypted token-to-value mappings; encrypted Aporta Chat conversations, with, unencrypted beside them, their owner, times, the model, token counts, and each attached file’s placeholder name, type, size, detection counts and, where it was kept, its copy’s storage reference; account metadata, including the browsers enrolled and their health reports, which name the browser and, where the customer turns that check on, other AI extensions installed in it, and who signed in on each browser; the customer’s settings, including the terms it adds to its custom detection list, unencrypted; for a file sent for attachment review and for a request to send a tokenized value, the requester’s stated reason and any reason for refusing it, and for the file its original name, unencrypted; the encrypted credential for a connected export destination; Aporta’s wrapped copies of each customer’s data keys, which open nothing without the Amazon Web Services key below; and the copies of the vault key wrapped to the customer’s own browsers and recovery code, which Aporta cannot open. Turso keeps restore points of each database for a period, and may be able to restore a deleted database for up to five days after deletion | United States |
| WorkOS, Inc. | Sign-in, directory and role assignment | Names, work email addresses, role assignments. No prompt content. WorkOS may use sign-in data to improve its own service, under §3(i) of its addendum | United States |
| Resend (Plus Five Five, Inc.) | Sends our system’s email: to your administrators, a notice that browsers are waiting to be enrolled; to your Super Users, a notice that your directory removed your organization’s only Super User and we kept their access, notices about your subscription (a change of fee band, a pilot about to convert to a paid subscription, a cancellation scheduled or withdrawn), a notice that a classification of a detection format awaits your review, and a notice that one of your Super Users asked us for help signing in while your identity provider was unavailable; to Aporta’s own mailboxes, our copies of those notices, alerts about our own systems and providers, and a notification of each beta sign-up from this website | Recipients’ email addresses, which also show your domain. The Super User notice names the email address your directory removed and the directory’s event identifier; our copy carries our opaque account ID for your organization and that event identifier. The sign-in help notice names the Super User who asked. Subscription notices give dates, fee bands and user counts. The classification notice gives only a deadline, and nothing about the format. The enrollment notice gives only a count and a waiting time. Our copies of subscription and sign-in notices carry our opaque account ID for your organization, not its name. Our system alerts name the affected AI tool or provider, give counts, and describe our own test browsers. A sign-up notification carries the whole sign-up. No prompt content, token mappings or audit records. Resend keeps delivery metadata under its own terms | United States |
| Microsoft Corporation | Our business email, document storage and support correspondence | Contact details, and anything personal in correspondence, contracts or support requests, including beta sign-up notifications, which are deleted automatically one year after they arrive. No prompt content, token maps or audit records | United States |
| Stripe, LLC | Payment processing and billing | Billing contact name and email, subscription and invoice records. Card details go to Stripe directly and are never held by us. No prompt content. Stripe also uses payment data on its own account for fraud prevention and regulatory compliance | United States |
| Twilio Inc. | Text-message alerts to Aporta staff when part of our extension stops working on a supported AI tool’s site, and when it is no longer reported. Never sent to customers | Mobile numbers of the Aporta staff who receive alerts, and Twilio’s own log of who was messaged and when. Our messages name the affected AI tool and part of the extension, and count the browsers and customer organizations that reported it. They carry no organization name, user identifier, email address or page content. This describes what we put in a message, not what Twilio records beyond the message and its log | United States (Twilio US1 region) |
| Google LLC | Optional, off unless your Super User turns it on: Aporta Chat, a chat in the Aporta console answered through Gemini on Google Cloud (Agent Platform), on our account, while one of the five supported AI tools is blocked because our protection for it has broken. The demo on this website, through the same service | Aporta Chat: with each message, the conversation so far: the person’s messages, text extracted from attached spreadsheets, Word documents and presentations, and Gemini’s earlier answers, after the values our detection found are replaced with placeholders. Detection is the same as on the five tools and is not perfect, so the text may still contain personal data. No files, token mappings, audit records, or identifier of you or your employer. Demo: up to 2,000 characters a visitor sends, after the demo’s own replacement; anything it misses is sent as typed; no visitor identifier. For both: under Google’s Cloud terms, unless we instruct otherwise, Google does not keep the text outside our account longer than needed to answer, does not keep the answer there, and does not train on either. If its safety checks flag a request, Google may keep that text for up to 90 days, where it was processed, and its staff may read it. We have not established whether Google keeps its own technical record of each call | Google’s United States endpoint, processed in the United States |
| Amazon Web Services, Inc. | Key management: holds the key that wraps each customer’s data keys, which protect the vault, the audit record, the export-destination credential and stored Aporta Chat conversations | Data keys sent to be wrapped or unwrapped. Each request carries our opaque account ID for your organization and the key’s purpose and version, so AWS can see which customer’s keys are used, how often, whether you have connected an export destination (not which one), and whether your organization has used Aporta Chat. These appear in call records on our AWS account. The wrapping key is generated in AWS hardware and cannot be exported. No prompt content, token mappings, audit records, names or email addresses | United States (us-east-1) |
Website only, not Customer Data. For this website’s demo and beta sign-up form, we are the controller and Google, Cloudflare, Resend and Microsoft are our processors.
When your organization connects Microsoft OneDrive or a SharePoint document library in its own Microsoft 365, or an Amazon S3 bucket in its own Amazon Web Services account, for export delivery, where we offer that destination, Microsoft or Amazon Web Services holds that file for you under your agreement with them; they are not our sub-processors for it. Nor is Microsoft our sub-processor when your SharePoint administrator grants our application access to one site from the Aporta console, where we offer that: the grant is made in your own Microsoft 365. Microsoft and Amazon Web Services are our sub-processors only for the purposes in the table above. Our Privacy Policy, sections 3 and 9, describes export delivery.
Notice our providers give us
| Provider | Notice of a new sub-processor |
|---|---|
| Microsoft | Six months for customer data; thirty days for sub-processors supporting AI features, and for other personal data |
| Amazon Web Services | Thirty days |
| Cloudflare | Thirty days |
| Thirty days | |
| Modal | Thirty days, but it may replace a provider urgently and tell us as soon as reasonably practicable |
| Stripe | Thirty days, to a subscribed account; we are subscribed |
| WorkOS | Fourteen days, or as little as two where its Standard Contractual Clauses apply |
| Resend | Fourteen days |
| Turso | Ten days |
| Twilio | No fixed period, only as soon as reasonably practicable |
For a change that starts with Modal, WorkOS, Resend, Turso or Twilio, we cannot give you the thirty days we promise. We pass on what notice we have as soon as we have it.
Questions
Changelog
1.24, 26 October 2026. Stripe no longer counts among the providers that give us less notice than we promise: it gives thirty days to a subscribed account, and we are subscribed to its service-provider list changes. The Turso entry now names Aporta’s wrapped copies of each customer’s data keys, and says Turso keeps restore points of each database and may be able to restore a deleted one for up to five days. The Turso entry also names the unencrypted custom detection terms, the stated reasons and original file names of review and send requests, browser health reports and sign-in records, and the copies of the vault key wrapped to the customer’s own browsers and recovery code. The Modal entry says a request over 2 MiB passes through Modal’s central storage in the United States. The Resend entry lists the subscription, classification and sign-in help notices it also sends. The Twilio entry says the second message is sent when a failure is no longer reported, not when it is confirmed fixed. Microsoft’s thirty days also covers other personal data. No provider added or removed.
1.23, 21 October 2026. The Google entry describes Aporta Chat, which replaces the single-question Gemini answer. It sends the conversation so far and the text of attached files, after the same detection as on the five tools. The Turso, Cloudflare and Amazon Web Services entries now cover stored Aporta Chat conversations, and the Cloudflare entry names the tokenized copies of attached files kept with the audit record. The notice we give now also covers materially extending what a provider does. Microsoft is not our sub-processor for a SharePoint site grant made from the Aporta console, where we offer it, either. No provider added or removed.
1.22, 19 October 2026. Export delivery, where we offer that destination, is to Microsoft OneDrive or a SharePoint document library in the customer’s own Microsoft 365, or an Amazon S3 bucket in the customer’s own Amazon Web Services account, and neither provider is our sub-processor for the delivered file. Google Drive is not a delivery destination. No provider added or removed.
1.21, 13 October 2026. The Cloudflare entry now lists everything unencrypted at the edge: text extracted from attached files and the values detection replaces; restored values while Aporta holds the vault key; the audit payload before it is sealed and when it is queried or exported; and the original of a file submitted for attachment review, stored sealed for up to 72 hours. The WorkOS entry says WorkOS may use sign-in data to improve its own service, and its notice period may be as little as two days. The website demo and sign-up form are marked as website only. The Resend, Twilio and Google entries now use US spelling (“enrollment”, “organization”). No provider added or removed.
1.20, 8 October 2026. Corrected the Modal entry: a customer cannot turn second-tier detection off. Stripe now counts among the providers that give us less notice than we promise, because it gives thirty days only to a subscriber and offers no subscription.
1.19, 8 October 2026. Rewritten for clarity. No provider added or removed. Google and Microsoft are no longer listed as our sub-processors for delivering a sealed export into a customer’s own storage: the provider holds that file under the customer’s own agreement with it, and our terms with each provider for those calls do not make it our processor. The qualification that we had not yet read those terms is removed, and so is the section on export delivery, which the Privacy Policy covers. Removed the explanatory notes on providers’ own vendors, on software stores, and on how each provider’s notice terms work. The Google entry no longer mentions excluding our account from Google’s safety-check logging or Google’s in-memory cache.
Earlier versions, each with its own changelog: aportasystems.com/legal/subprocessors/versions