Sub-processors
Every third party that can process personal data on our behalf, what it does, and where it is. This page forms part of the Data Processing Addendum, and we give 30 days' notice before anything is added to it.
1. What this list is
A sub-processor is a company we engage that could, in the course of its work, process personal data belonging to you or contained in your Customer Data. We keep the list short on purpose: every entry is another organisation with potential access, another contract to hold, and another thing for your procurement team to assess.
2. Current sub-processors
| Sub-processor | What it does for us | Data it can reach | Location |
|---|---|---|---|
| Amazon Web Services contracting entity confirmed on request |
Hosting and infrastructure — compute, storage, database, backups, DNS and the content delivery network in front of this website. | All Customer Data and Account Data, encrypted at rest. AWS does not access it in the ordinary course; it is the infrastructure it sits on. | United States — US East (N. Virginia) |
| Amazon Simple Email Service (AWS) | Transactional email — account verification, password resets, security alerts, workspace-ready and billing notices. | Recipient name and email address, and the content of the message sent. | United States — US East (N. Virginia) |
| Paddle contracting entity confirmed on request |
Payment processing and subscription billing. May act as merchant of record for the transaction. | Billing contact details, company and tax registration details, transaction and invoice records. Card details are collected by Paddle directly and never reach our systems. | United Kingdom and European Union, with global processing |
On the hosting location. The platform runs in a United States AWS region today, which means personal data is transferred outside the Kingdom of Saudi Arabia. We state it here as well as in the Privacy Notice and the DPA, because it is the fact most likely to matter to a Saudi buyer and the one least likely to be assumed. Moving to a Saudi region is on the roadmap and is not done.
On Paddle. Paid billing is not yet live and the payment integration is in test mode, so no payment data is flowing to Paddle at present. The entry is listed because it will be, and we would rather over-disclose than add a processor quietly later.
On contracting entities. Each of these providers contracts through more than one legal entity depending on region and account type, and which entity applies changes the cross-border analysis. We confirm ours in writing during due diligence rather than name one here that might be wrong — a wrong entity is worse than none, because it is the thing your assessment turns on.
And ourselves. Not a sub-processor — we are the processor — but worth stating in the same place, because it is the same question for your assessment: our own personnel are located in India and administer and support the Service from there. That is a second transfer outside the Kingdom, alongside the United States hosting above.
3. Not sub-processors
Worth stating explicitly, because their absence is unusual and is a deliberate choice:
- No analytics provider. We load no third-party analytics on this website or in the product.
- No advertising or marketing technology. No pixels, no ad networks, no data brokers.
- No error-tracking or session-replay service. Nothing records what you do on screen and sends it to a third party.
- No third-party font or script CDN on this website. Everything is served from our own origin, which is why visiting this page tells nobody else that you did.
- No CRM or support-desk platform. Support tickets raised in the product stay in our own systems. Email we exchange with you sits in our business mailbox like any company's — if you need that provider named for your own assessment, ask and we will tell you.
If any of that changes, it goes on the list above with 30 days' notice first.
4. Optional AI providers
The AI features — Phone Scan, AI Search, AI Cost Estimator and AI line matching — are in development and not yet offered, so no AI provider processes your data today. The link suggestions the Service already makes are rule-based and run inside the Service, with no outside provider. The Service works without the AI features, and add-on AI features are not enabled unless you turn them on. When a feature is released, the arrangements below apply to it.
- Where the feature runs against a cloud AI subscription you hold, that provider is your processor, not ours. Your agreement with them governs it, and the data does not pass through an account of ours.
- Where you ask us to provide access on a metered pass-through instead, the model provider becomes our sub-processor for that feature. We will name it on this page, with notice, before that option is offered.
- Where an AI feature is included in your plan, such as Phone Scan, it runs on a provider we engage. That provider becomes our sub-processor: we add it to section 2 with 30 days' notice before the feature is enabled, and it processes only the documents a user chooses to scan.
- Where we engage the provider, your content is not used to train models — ours, or the provider's — and we contract for that. Where you hold the subscription, your agreement with that provider governs it.
5. How we notify you of changes
- We give at least 30 days' notice before adding or replacing a sub-processor.
- Notice is sent by email to your workspace administrators, and this page is updated with the change recorded in section 6.
- You may object on reasonable data-protection grounds within those 30 days. We will work with you in good faith on an alternative; if there is not one, you may terminate the affected subscription without penalty and receive a pro-rata refund for the unused period.
- We impose obligations on each sub-processor no less protective than those in our DPA, and we remain liable to you for their performance.
Keep your workspace administrator contacts current — that is the address a notice goes to.
6. Change history
| Date | Change |
|---|---|
| 8 September 2026 | Initial publication. |
| 12 September 2026 | Section 4 clarified: the AI features are in development and not yet offered, so no AI provider processes customer data; added how the provider for an AI feature included in a plan will be engaged. |
Contact
To object to a sub-processor, to ask which contracting entity applies, or to ask about a provider not listed here, email info@smrfuturetechnologies.com.
Related documents: Terms of Service · Privacy Notice · Data Processing Addendum