Status: Founder approved. Version: 1.0 Effective date: September 14, 2026.
Last updated
September 14, 2026. This document is
versioned; historical versions are accessible at
https://trust.atlasent.io/legal/archive/subprocessors/.
What this page is
A sub-processor is a third party that AtlaSent Systems, Inc. ("AtlaSent") engages to process Customer Personal Data in connection with the AtlaSent service. The table below lists every current sub-processor, the service they provide, the categories of data they process, where they process it, and the cross-border transfer mechanism we rely on if processing occurs outside the European Economic Area (EEA) or United Kingdom.
This list is incorporated by reference into the AtlaSent Data Processing Agreement and the Master Services Agreement.
Change notification
We notify customers in writing of:
(a) any addition or replacement of a sub-processor processing Customer Personal Data at least thirty (30) days before the change takes effect; and (b) any material change in the scope or location of processing by an existing sub-processor at least sixty (60) days before the change takes effect. For purposes of (b), "material change" means any change that (i) moves processing from the European Economic Area to a third country, (ii) materially expands the categories of Customer Personal Data processed, or (iii) materially changes the categories of Data Subjects affected.
Customers who object to a new sub-processor in good faith may invoke
the objection procedure in §11.4 of the DPA. To receive notifications,
subscribe at https://trust.atlasent.io/subprocessors/subscribe (RSS
available) or email subprocessors@atlasent.io.
Material changes to the scope of an existing sub-processor's processing follow the 60-day notice rule in (b). Enablement of any sub-processor currently listed under Conditionally scoped sub-processors (below) for a production workflow that would Process Customer Personal Data is itself an addition under the 30-day notice rule in (a).
Non-material changes (e.g., corporate restructuring of an existing sub-processor without change of legal entity or processing scope) are updated here without separate notice.
Current sub-processors
| Sub-processor | Service provided | Categories of Customer Personal Data | Processing location | Transfer mechanism (if outside EEA/UK) | Sub-processor DPA |
|---|---|---|---|---|---|
| Supabase, Inc. (Delaware, USA) | Managed Postgres database, authentication, file storage, and edge function runtime that hosts the AtlaSent API and Console. | Authentication identifiers (email, hashed password, SSO IDs); organization metadata; policy and permit records; audit chain entries; API key hashes. | Customer-selected AWS region (default: us-east-1). EU customers may select an EU region at project provisioning time, subject to AtlaSent's plan-tier configuration. | EU SCCs (2021/914) Module 2; UK IDTA addendum. Supabase DPA in effect. | https://supabase.com/legal/dpa |
| Resend, Inc. (Delaware, USA) | Transactional email delivery (admin invites, security notifications, audit-export delivery). Email body content is determined by Customer's configuration of the Service. Customers using the Service in a regulated-data context (e.g., under a BAA) must configure transactional email templates to avoid embedding PHI. | Recipient email address, recipient display name, subject line, email body content. | United States. | EU SCCs (2021/914) Module 3; UK IDTA addendum. | https://resend.com/legal/dpa |
| Stripe, Inc. (Delaware, USA) and applicable Stripe affiliates | Subscription billing and payment processing for AtlaSent customers. The Stripe contracting entity varies by region (Stripe, Inc. for US customers; Stripe Payments Europe Ltd for EU customers; Stripe Payments UK Ltd for UK customers); the applicable entity is identified to Customer at checkout. | Billing contact name and email, company name, billing address, tax ID, last four digits of payment instrument, transaction history. Full payment card numbers never touch AtlaSent systems — they are entered directly into Stripe Checkout / Elements. | Primarily United States, with regional Stripe entities processing in their respective regions for non-US customers. | EU SCCs (2021/914) Module 2; UK IDTA addendum. Stripe is independently PCI DSS Level 1 certified. | https://stripe.com/legal/dpa |
| Railway, Inc. (Delaware, USA; principal place of business 548 Market Street, PMB 68956, San Francisco, CA 94104) | Containerised application hosting and HTTP/TLS termination for the AtlaSent Console (console.atlasent.io). The Console is deployed as a Docker container; the AtlaSent API and Supabase are addressed directly from the client browser, so audit-chain content and authorization decision bodies do not transit Railway. | Connection metadata for Console requests (IP address, user agent, request headers); Console-initiated request bodies handled by the Console application. | United States — West region (Railway runs on underlying cloud providers; the AtlaSent Console project is deployed in Railway's US West region). | EU SCCs (2021/914) Module 2; UK IDTA addendum. | https://railway.com/legal/dpa |
| Cloudflare, Inc. (Delaware, USA) | DNS resolution and DDoS / WAF protection for *.atlasent.io and *.atlasent.com endpoints; Cloudflare Turnstile for bot protection on authentication forms. | Connection metadata (IP address, request headers, TLS fingerprint); Turnstile challenge response payloads. No request bodies are stored. | Global edge locations. EU-originated traffic is terminated at Cloudflare's EU edge locations; non-EU traffic at the geographically nearest edge. | EU SCCs (2021/914) Module 2; UK IDTA addendum. | https://www.cloudflare.com/cloudflare-customer-dpa/ |
Engineering providers that do not process Customer Personal Data in the ordinary course are not subprocessors and are not included in this list.
Conditionally scoped sub-processors
The following potential sub-processor integrations exist in the AtlaSent codebase behind controlled feature flags and environment-bound access controls. They are not currently enabled for general customer production use and do not currently Process Customer Personal Data. They are disclosed here so that customers have advance visibility of potential future scope. Enablement for any production workflow that would route Customer Personal Data through these services constitutes a new-sub-processor addition under the Change notification rule above and will be moved into the Current sub-processors table at least thirty (30) days before such enablement takes effect, with notice to the change-notification list.
Anthropic, PBC (Delaware, USA)
Status. Conditionally scoped — not currently enabled in production.
Disclosure. Anthropic integration points currently exist behind controlled feature flags and are not enabled for general customer production use. Current production workflows do not route customer-controlled production data through Anthropic services. As a result, Anthropic-related controls remain conditionally scoped pending formal production enablement and associated governance review.
Intended scope if enabled. Claude API used for AI-assisted policy drafting and VQP narrative generation only when a customer opts in. Customer Personal Data would not be sent to Anthropic by default. If enabled by a Customer, the only Personal Data in scope would be policy text drafted by the Customer; decision-event data and audit-chain content would not be sent. Per Anthropic's API terms, prompts and completions are not used to train models.
Production location if enabled. United States.
Transfer mechanism if enabled. EU SCCs (2021/914) Module 2 via
Anthropic's customer DPA (https://www.anthropic.com/legal/dpa).
Governance boundary. Enablement requires (1) publication of an
updated Sub-processor list moving Anthropic into the Current
sub-processors table with at least thirty (30) days' prior notice;
(2) Customer-level opt-in at the organization administrator level,
recorded in the audit chain; and (3) tier-appropriate contractual
mechanism. As of the date of this disclosure, conditions (1)–(3) are
not satisfied for any production customer workflow. AtlaSent technical
controls (AI_API_KEY / AI_GATEWAY_URL env-var gating, feature flag)
implement the foregoing but are operational measures, not contractual
substitutes for them.
Past sub-processors
None. This document was first published on September 14, 2026. As entries are added or replaced, the prior entry will be moved to this section with the date of cessation.
Affiliates
AtlaSent Systems, Inc. has no affiliated entities that process Customer Personal Data as of the effective date.
Questions
Email subprocessors@atlasent.io or compliance@atlasent.io.