Sub-processors
This page is provided for transparency only and is not legal advice.
A sub-processor is a third party engaged by Genlobe to process personal data on our behalf in the course of delivering our services. We carefully select each sub-processor and bind it by a data-processing agreement consistent with applicable data-protection law.
| Name | Service | Region | Transfer safeguard |
|---|---|---|---|
| Amazon Web Services | Hosting (Elastic Beanstalk / Amplify), transactional email (SES), file storage and backups (S3), and — as our database migration completes — managed database (RDS) | us-east-1 (United States) | EU SCCs / EU-U.S. DPF |
| Supabase | Managed Postgres database (account and end-user records); being migrated to AWS (RDS / S3) | United States | EU SCCs |
| Stripe | Payments — Tier-1 (platform) and per-Organization BYO (Tier-3) | United States and global | EU SCCs / EU-U.S. DPF |
| OpenRouter | LLM gateway (all AI traffic is routed through it) | United States | EU SCCs (ZDR / no-training to be confirmed) |
| Anthropic, OpenAI and others (via OpenRouter) | Model inference; providers may retain API input/output for ~30 days for trust & safety | United States | Back-to-back via OpenRouter |
| OAuth social login for end-users (only if the tenant enables it) | United States | EU SCCs | |
| Sentry (Functional Software, Inc.) | Application error and performance monitoring — exception and diagnostic data, which may include request context (e.g. URL, user identifier, IP) | United States | EU SCCs / EU-U.S. DPF |
Changes to this list
We will give notice before adding or replacing a sub-processor that processes personal data. Customers may object to a new sub-processor within a 30-day window from the date of notice. If we cannot accommodate a reasonable objection, you may terminate the affected service.