Sub-processors — version 1.22
In effect from 2026-10-19. Supersedes version 1.21. Previous versions remain available at/legal/subprocessors/versions/.
Sub-processors
Version 1.22 · In effect from 19 October 2026 · supersedes 1.21
Aporta Systems, LLC uses the providers below to deliver the Service and to run this website. Each is engaged under a written data processing agreement, and we remain responsible to our customers for what each of them does.
We give customers at least thirty days’ notice before we add or replace a provider, and a right to object on reasonable data protection grounds.
| Provider | Purpose | Data it can reach | Location |
|---|---|---|---|
| Cloudflare, Inc. | Edge compute; audit record storage; DNS and email routing; cookieless analytics on this website and the Aporta dashboard; storing this website’s beta sign-ups | Prompt text, and text extracted from attached files, unencrypted at the edge while detection runs, including the values detection then replaces with tokens. Detected values, unencrypted at the edge where the Service restores them into an AI tool’s reply while Aporta holds the vault key; after a Super User takes custody of the key, token mappings pass through the edge only sealed and are opened in the browser. The audit payload, unencrypted at the edge until it is sealed there, and opened there again when an authorized user queries or exports the record; it carries tokens in place of detected values. A file submitted for attachment review is the unscanned original: it is received unencrypted at the edge, stored sealed for up to 72 hours, and opened at the edge for the approver. Tokenized content in transit; encrypted audit records. Aggregate analytics only, with no cookie or visitor identifier. Beta sign-ups: full name, work email, business name, role, free text about how the team uses AI, and arrival time, but not the network address; deleted automatically one year after submission | United States for storage. Edge processing runs at the location nearest the user, including outside the United States, and is not stored there |
| Modal Labs, Inc. | Second-tier detection | Prompt text and extracted attachment text, unencrypted, during detection. Processed in memory and not retained. Part of the Service; a customer cannot turn it off | United States |
| Turso (ChiselStrike, Inc.) | Per-customer vault and metadata databases | Encrypted token-to-value mappings; account metadata; the encrypted credential for a connected export destination | United States |
| WorkOS, Inc. | Sign-in, directory and role assignment | Names, work email addresses, role assignments. No prompt content. WorkOS may use sign-in data to improve its own service, under §3(i) of its addendum | United States |
| Resend (Plus Five Five, Inc.) | Sends our system’s email: to your administrators, a notice that browsers are waiting to be enrolled; to your Super Users, a notice that your directory removed your organization’s only Super User and we kept their access; to Aporta’s own mailboxes, our copy of that notice, alerts about our own systems, and a notification of each beta sign-up from this website | Recipients’ email addresses, which also show your domain. The Super User notice names the email address your directory removed and the directory’s event identifier; our copy carries our opaque account ID for your organization and that event identifier. The enrollment notice gives only a count and a waiting time. Our system alerts name the affected AI tool, give counts, and describe our own test browsers. A sign-up notification carries the whole sign-up. No prompt content, token mappings or audit records. Resend keeps delivery metadata under its own terms | United States |
| Microsoft Corporation | Our business email, document storage and support correspondence | Contact details, and anything personal in correspondence, contracts or support requests, including beta sign-up notifications, which are deleted automatically one year after they arrive. No prompt content, token maps or audit records | United States |
| Stripe, LLC | Payment processing and billing | Billing contact name and email, subscription and invoice records. Card details go to Stripe directly and are never held by us. No prompt content. Stripe also uses payment data on its own account for fraud prevention and regulatory compliance | United States |
| Twilio Inc. | Text-message alerts to Aporta staff when part of our extension stops working on a supported AI tool’s site, and when it recovers. Never sent to customers | Mobile numbers of the Aporta staff who receive alerts, and Twilio’s own log of who was messaged and when. Our messages name the affected AI tool and part of the extension, and count the browsers and customer organizations that reported it. They carry no organization name, user identifier, email address or page content. This describes what we put in a message, not what Twilio records beyond the message and its log | United States (Twilio US1 region) |
| Google LLC | Optional, off unless your Super User turns it on: answering a question through Gemini on Google Cloud (Agent Platform), on our account, while one of the five supported AI tools is blocked because our protection for it has broken. The demo on this website, through the same service | Gemini answer: the text of one question, after fixed-format values and your employer’s terms are replaced with placeholders. Names, places and organizations are not detected and are sent as typed, so the text may still contain personal data. No attachments, earlier messages, token mappings, audit records, or identifier of you or your employer. Demo: up to 2,000 characters a visitor sends, after the demo’s own replacement; anything it misses is sent as typed; no visitor identifier. For both: under Google’s Cloud terms, unless we instruct otherwise, Google does not keep the text outside our account longer than needed to answer, does not keep the answer there, and does not train on either. If its safety checks flag a request, Google may keep that text for up to 90 days, where it was processed, and its staff may read it. We have not established whether Google keeps its own technical record of each call | Google’s United States endpoint, processed in the United States |
| Amazon Web Services, Inc. | Key management: holds the key that wraps each customer’s data keys, which protect the vault, the audit record and the export-destination credential | Data keys sent to be wrapped or unwrapped. Each request carries our opaque account ID for your organization and the key’s purpose and version, so AWS can see which customer’s keys are used, how often, and whether you have connected an export destination (not which one). These appear in call records on our AWS account. The wrapping key is generated in AWS hardware and cannot be exported. No prompt content, token mappings, audit records, names or email addresses | United States (us-east-1) |
Website only, not Customer Data. For this website’s demo and beta sign-up form, we are the controller and Google, Cloudflare, Resend and Microsoft are our processors.
When your organization connects Microsoft OneDrive or a SharePoint document library in its own Microsoft 365, or an Amazon S3 bucket in its own Amazon Web Services account, for export delivery, where we offer that destination, Microsoft or Amazon Web Services holds that file for you under your agreement with them; they are not our sub-processors for it. Microsoft and Amazon Web Services are our sub-processors only for the purposes in the table above. Our Privacy Policy, sections 3 and 9, describes export delivery.
Notice our providers give us
| Provider | Notice of a new sub-processor |
|---|---|
| Microsoft | Six months for customer data; thirty days for sub-processors supporting AI features |
| Amazon Web Services | Thirty days |
| Cloudflare | Thirty days |
| Thirty days | |
| Modal | Thirty days, but it may replace a provider urgently and tell us as soon as reasonably practicable |
| Stripe | Thirty days, but only to a subscriber, and Stripe offers no subscription. We check its list weekly |
| WorkOS | Fourteen days, or as little as two where its Standard Contractual Clauses apply |
| Resend | Fourteen days |
| Turso | Ten days |
| Twilio | No fixed period, only as soon as reasonably practicable |
For a change that starts with Modal, Stripe, WorkOS, Resend, Turso or Twilio, we cannot give you the thirty days we promise. We pass on what notice we have as soon as we have it.
Questions
Changelog
1.22, 19 October 2026. Export delivery, where we offer that destination, is to Microsoft OneDrive or a SharePoint document library in the customer’s own Microsoft 365, or an Amazon S3 bucket in the customer’s own Amazon Web Services account, and neither provider is our sub-processor for the delivered file. Google Drive is not a delivery destination. No provider added or removed.
1.21, 13 October 2026. The Cloudflare entry now lists everything unencrypted at the edge: text extracted from attached files and the values detection replaces; restored values while Aporta holds the vault key; the audit payload before it is sealed and when it is queried or exported; and the original of a file submitted for attachment review, stored sealed for up to 72 hours. The WorkOS entry says WorkOS may use sign-in data to improve its own service, and its notice period may be as little as two days. The website demo and sign-up form are marked as website only. The Resend, Twilio and Google entries now use US spelling (“enrollment”, “organization”). No provider added or removed.
1.20, 8 October 2026. Corrected the Modal entry: a customer cannot turn second-tier detection off. Stripe now counts among the providers that give us less notice than we promise, because it gives thirty days only to a subscriber and offers no subscription.
1.19, 8 October 2026. Rewritten for clarity. No provider added or removed. Google and Microsoft are no longer listed as our sub-processors for delivering a sealed export into a customer’s own storage: the provider holds that file under the customer’s own agreement with it, and our terms with each provider for those calls do not make it our processor. The qualification that we had not yet read those terms is removed, and so is the section on export delivery, which the Privacy Policy covers. Removed the explanatory notes on providers’ own vendors, on software stores, and on how each provider’s notice terms work. The Google entry no longer mentions excluding our account from Google’s safety-check logging or Google’s in-memory cache.
Earlier versions, each with its own changelog: aportasystems.com/legal/subprocessors/versions