DPA Annex C — Subprocessors
Version: 2026-11-08
Provider: SiteAxis · Customer: the business identified in the account or Order · Approved schedule ID: SP-2026-11-08 · Approved version date: November 8, 2026.
1. Executable approved subprocessor schedule — NOT COMPLETE
No vendor is approved by this unfinished table. Before incorporation into a signed DPA, populate one row for every active third party that processes Customer Personal Data on behalf of SiteAxis, record subprocessor legal entity and actual service/region, and document the executed terms and Customer notice mechanism. Remove all unapproved candidates and blank rows.
| Legal entity / trade name | Service purpose | Data classes | Storage + access regions | Subprocessor DPA/contract version | Transfer instrument | Status / effective date |
|---|---|---|---|---|---|---|
| Supabase, Inc. | Database, authentication and file storage | All Customer Content and account data | Canada (Montréal); support access from U.S. | Supabase DPA | Contractual safeguards | Active, November 8, 2026 |
| Vercel Inc. | Application hosting and delivery | Request data and logs | United States; global edge | Vercel DPA | Contractual safeguards | Active, November 8, 2026 |
| Postmark (ActiveCampaign, LLC) | Transactional email | Name, email address, notification content | United States | Postmark DPA | Contractual safeguards | Active, November 8, 2026 |
| Additional entries | Stripe, Inc. (payments; billing contact and payment data; U.S./Canada); Alibaba Cloud Model Studio (AI features, only when enabled; record text, safety form answers and photos; U.S. Virginia; not used for training); Google LLC and Microsoft Corporation (optional sign-in; name, email, identity token; U.S.); GitHub, Inc. (schedule file processing; uploaded P6/XER files; U.S.) | — | — | — | — | — |
2. Change notice and customer objection
SiteAxis will maintain a dated, version-controlled list and notify Customer of a proposed new/replacement Subprocessor 30 days in advance using email to the Customer's account administrators and an update to the published subprocessor list to the designated address. Customer may object within 30 days on reasonable documented data-protection grounds. The Parties will attempt mitigation or an alternative. If material concerns cannot be reasonably addressed, the remedy is termination of the affected Services with a pro-rata refund of prepaid fees for the unused period under the DPA. Emergency replacements are subject to the DPA's accelerated notice restriction and mandatory law.
3. Data transfer record for each approved vendor
For each provider, record:
- Actual processing categories and sensitive safety/incident content exposure.
- Primary and backup locations, global/support access, onward subprocessors and subprocessors' authorized scope.
- Contract/DPA identifier and URL/file hash; data transfer safeguards/impact assessment; retention and deletion options.
- Required advance notice and contact, vendor incident reporting rules, escalation channel.
- Last runtime/configuration verification date and reviewer names.
Business owner: SiteAxis Privacy Officer · Last reviewed: November 8, 2026 · Vendor contract review: Provider terms and data-processing agreements reviewed November 8, 2026.
Questions about these documents?
Contact the SiteAxis team for help with a policy or agreement.