Subprocessors

This page describes the subprocessors that Spifex uses to provide the website and services, as required by our Data Processing Agreement.

Current subprocessors

Provider	Purpose	Processing location
Vercel Inc.	Website hosting, edge delivery and performance	Global edge network, including the EU and United States
Hostinger International Ltd.	Application hosting, database, storage, backups and business email	EU/EEA and other locations used by Hostinger, with appropriate transfer safeguards
Payment provider	Subscription billing, invoices and payment processing	EU/EEA and United States, with appropriate transfer safeguards

The payment provider used for a specific purchase is identified at checkout and in the applicable order. A current named list of subprocessors, including the payment provider, is available from legal@spifex.com.

AI connections

AI connections are authorized by the customer for a specific workspace and user. When a customer connects an assistant such as ChatGPT or Claude, the customer decides which external provider to use and authorizes the connection. Those external AI providers process data under their own terms and privacy notices.

Spifex does not use customer workspace data to train external AI models. AI connections are read-only and limited to the scopes shown in the product.

Why some providers are not listed individually

Some providers are used only for the marketing website, for aggregate security monitoring, or as infrastructure sub-processors whose details are provided in the DPA annex. We list the provider categories and the main named providers so customers can assess the processing.

We do not list providers that are used solely for internal operations without processing customer personal data.

Changes and notice

We review subprocessors regularly. Before adding a subprocessor that will process customer personal data, we will:

assess its security and data protection posture;
enter into appropriate data protection terms;
update this page or the DPA annex; and
provide notice to customers where required by the DPA or applicable law.

Customers can subscribe to subprocessor change notifications by emailing legal@spifex.com.

Objections

Customers may object to a new subprocessor on reasonable data protection grounds. We will discuss the concern in good faith and, where no reasonable resolution is possible, the customer may terminate the affected services as permitted by the agreement.

International transfers

Where a subprocessor processes personal data outside the EU/EEA, we rely on an adequacy decision, the European Commission’s Standard Contractual Clauses (2021/914), the UK International Data Transfer Addendum or another lawful transfer mechanism.