Sub-Processor List
Every service that may process customer personal information on Inscendo's behalf, its role, and where it processes it. A new sub-processor is posted thirty days before it starts, subscribers are notified, and customers may object.
Inscendo: Sub-Processor List
Effective Date: This Version 1.0 is effective on the date it is posted at https://inscendoiq.com/legal/subprocessors. A Sub-Processor added later is engaged from the date shown in its row.
Version: 1.0 (October 19, 2026 — first published as its own document. The table in § 1 is the table that Data Processing Addendum § 6.2 carried through DPA version 1.10, with its cross-references pointed at the documents that now hold the detail; no Sub-Processor is added, removed, or given a new role, and no region changes. From DPA version 1.11, the DPA incorporates this List by reference, and DPA § 6 says how it changes.)
Provider: Inscendo Automation Inc., a Texas corporation ("Inscendo")
This List names every Sub-Processor Inscendo engages to process Customer Personal Information for the Inscendo Service, what each one does, and where it processes that information. It is incorporated by reference into the Data Processing Addendum ("DPA") § 6 and is a Referenced Document under the Master Subscription Agreement ("MSA") § 15.7. Capitalized terms not defined here have the meanings given in the DPA and the MSA.
1. Current Sub-Processors
| Sub-Processor | Role | Region |
|---|---|---|
| AI foundation-model provider | Primary AI model provider; processes prompts and generates outputs | United States |
| AI embedding provider | Embedding provider; turns text submitted to memory, document-search, and conversation-search features into search vectors | United States |
| TypeSafe AI, Inc. | AI decision model for the Service's typed-decision features (Data Location Statement § 2), in use since October 14, 2026, engaged through Vercel Inc.'s AI gateway under Vercel's agreements with it: reads the text the Service asks it about and returns only a choice, a yes/no likelihood, or a score, and generates no text; does not use that text to train models, and keeps it no longer than needed to produce the answer except where its legal obligations require | TypeSafe AI states that it hosts its service in the United States; not limited by contract to the United States (Data Location Statement § 2) |
| Vercel Inc. | AI gateway for the typed-decision features (Data Location Statement § 2), in use since October 14, 2026: routes each request only to TypeSafe AI, Inc. and returns its answer; deletes the request and the answer once the request completes, and does not use them to train models | United States; a request may also be received and processed in Vercel data centers outside the United States (Data Location Statement § 2) |
| Microsoft Corporation (Azure) | Cloud hosting and infrastructure | United States |
| Postmark (Wildbit, LLC) | Primary transactional and identity email delivery for platform notifications (e.g., account, security, and verification emails) | United States |
| Microsoft Azure Communication Services | Fallback transactional and identity email delivery for platform notifications | United States |
| Twilio Inc. | Delivery of the one-time sign-in, verification, and password-reset codes that Customer's authorized users ask for, by text message (SMS) or automated voice call; receives only the destination phone number, the code, the delivery channel, and whether the code was later used, and never Customer Data | United States |
| Stripe, Inc. | Payment processing for Wallet Funds; tokenized card storage | United States |
| Cloudflare, Inc. | Edge networking and reverse proxy; authoritative DNS for the domains Inscendo operates; DDoS protection and rate limiting; edge-based country-level access controls used and/or reserved to support the U.S.-only eligibility rule in MSA § 2.2 and DPA § 5.3; content-delivery network and edge caching; TLS termination; edge-level request analytics | United States |
| GoDaddy.com, LLC | Domain registrar (authoritative DNS is provided by Cloudflare; registrar only, does not process Customer application data) | United States |
| GitHub, Inc. | Source-code hosting and CI/CD for Inscendo's own platform code; does not, in the ordinary course, store Customer Configurations (which reside in per-tenant platform storage) or Customer Personal Information | United States |
| Backblaze, Inc. | Off-site, immutable (write-once) encrypted backup storage of Customer Data and Customer Configurations for disaster recovery (Security Measures § 6); each copy is retained for a fixed period not exceeding ninety (90) days and cannot be deleted earlier by anyone, including Inscendo (DPA § 12.1) | United States |
2. Providers Customer connects
A provider that Customer itself connects to the Service, such as an SMS, email, voice, chat, or other API provider, or a third-party AI application connected under Customer's own account with that application's provider (MSA § 4.9), is not listed here. It acts as a Sub-Processor only where, and to the extent, Customer chooses to connect and use it, as DPA § 6.2 states.
3. How this List changes
3.1 A new Sub-Processor. Inscendo adds a new Sub-Processor to this List, with the date it will begin processing Customer Personal Information, at least thirty (30) days before that date, and notifies subscribers as DPA § 6.3 states. Customer may object as DPA § 6.4 states.
3.2 Emergency replacement. Where Inscendo must replace a Sub-Processor sooner to keep the Service running or secure, it does so as DPA § 6.3 states and updates this List as soon as practicable.
3.3 Other changes. Removing a Sub-Processor, narrowing what one receives, or correcting a description takes effect when posted, and is recorded in this List's version history and in the change log described in MSA § 15.
3.4 Subscribing. Anyone may subscribe to changes to this List at https://inscendoiq.com/trust/subprocessors, by email or by feed. Customer is responsible for subscribing an address it monitors.
[End of Sub-Processor List]