{"data":{"id":"subprocessors","title":"Subprocessors","version":"0.9.0-draft","hash":"1fa8cb1e8a267687a108b4bfff5c9e183f23b95a8196c1ddb4a1121fcb63e141","status":"Draft — pending qualified counsel review","markdown":"---\ntitle: Subprocessors\ndocument_id: subprocessors\nversion: 0.9.0-draft\neffective_date: \"[[LEGAL_REVIEW_REQUIRED: effective date set at launch]]\"\nstatus: \"Draft — pending qualified counsel review\"\noperator: Audon Software LLC\nproduct: Audon\n---\n\n# Audon — Subprocessors\n\n> **Drafting note (remove before publication):** List only vendors actually deployed in production. Confirm each vendor's contracting entity, DPA and region before publication.\n\n**Audon Software LLC**, the operator of Audon, uses the third-party service providers below to deliver the Services. This list supports our Data Processing Addendum (document id `dpa`, Section 6 and Annex III) and our Privacy Policy (document id `privacy`).\n\n## 1. Current subprocessors\n\n| Vendor | Purpose | Categories of data | Processing location | Role relative to customer data | Status |\n|---|---|---|---|---|---|\n| Vercel Inc. | Application hosting, serverless compute, TLS termination | All data handled by the application in transit and in memory: account data, organization data, provider usage and cost reports, Telemetry | United States | Subprocessor | Active |\n| Neon | Managed PostgreSQL database, including backups | All stored data: account, organization, activity log, legal records, provider usage and cost reports, Telemetry, encrypted provider credentials | [[LEGAL_REVIEW_REQUIRED: Neon contracting entity and database hosting region]] | Subprocessor | Active |\n| Resend | Transactional email (sign-in, invitations, alerts, billing and legal notices) | Recipient name and email address; email content, which may include organization, project or key names and spend figures | [[LEGAL_REVIEW_REQUIRED: Resend contracting entity and processing region]] | Subprocessor | Planned — used only when transactional email is enabled |\n| Stripe | Payment processing, subscriptions, invoices, billing portal | Billing contact, Stripe customer and subscription identifiers, plan and payment status; card data entered directly with Stripe | [[LEGAL_REVIEW_REQUIRED: Stripe contracting entity for Audon account]] | Processor for Audon billing data, and independent controller for some payment data. Does not process provider usage data or Telemetry. | Test mode; live payments not enabled |\n\n## 2. Vendors that do not receive customer data\n\n| Vendor | Purpose | Note |\n|---|---|---|\n| GitHub | Source code hosting and continuous integration | Does not receive customer data or production secrets |\n\n## 3. What we do not use\n\nWe do not currently use any analytics, advertising, session-replay, error-monitoring, customer-support ticketing or AI/LLM vendor that receives customer data. Your AI providers (for example, OpenAI and Anthropic) are not our subprocessors: they are your own providers, from which we retrieve reports using the keys you supply.\n\n## 4. Data protection agreements\n\nWe enter into written agreements with each subprocessor that include data protection terms appropriate to the service. [[LEGAL_REVIEW_REQUIRED: confirm executed vendor DPAs and transfer mechanisms for each subprocessor]]\n\n## 5. Changes to this list\n\n- We will update this page **at least 30 days before** a new subprocessor begins processing customer personal data, and notify organization owners by email and in the Services.\n- Customers may object on reasonable data protection grounds within that period, as described in the DPA (Section 6.3).\n- Where an urgent change is needed for security or service continuity, we will give notice as soon as practicable.\n- Each version of this list has a version number and date, and previous versions are archived in our legal documents index.\n\nQuestions: [[LEGAL_REVIEW_REQUIRED: privacy contact email]].\n"},"meta":{"request_id":"req_01m61e51tct7tz7fytqpzx","operation":"legal.get"}}