GDPR Article 28 Compliance
Authorized Subprocessors
AlphaClone Systems LLC engages third-party infrastructure and service providers ("Subprocessors") to perform various functions necessary for providing our AI Business Execution Layer. All subprocessors are vetted for security, compliance, and confidentiality, and are bound by Data Processing Agreements with Standard Contractual Clauses (SCCs).
Subprocessor Change Notification: In accordance with our Data Processing Agreement, AlphaClone will provide customers with at least 14 days prior notice before engaging any new subprocessor. To subscribe to email alerts for subprocessor updates, submit a notice request to privacy@alphaclonesystems.com.
| Subprocessor | Purpose & Processing Role | Data Processed | Location | Transfer Safeguard |
|---|---|---|---|---|
| Cloudflare, Inc. | Edge routing, content delivery network (CDN), DDoS mitigation, Turnstile bot verification, and Zaraz consent tag management. | IP addresses, request headers, client security telemetry. | Global Edge Network (US Headquarters) | EU Standard Contractual Clauses (SCCs), Cloudflare DPA, UK IDTA |
| Supabase, Inc. | Production database hosting, encrypted document storage, user authentication, and row-level security policy enforcement. | User accounts, tenant profile details, encrypted client and document records, compliance logs. | United States (AWS us-east-1) | EU Standard Contractual Clauses (SCCs), Supabase DPA |
| Railway Corp. | Container application infrastructure, server-side Next.js execution layer, background queue workers. | Application logs, transient request payloads, session tokens. | United States (AWS us-east-1) | EU Standard Contractual Clauses (SCCs), Railway DPA |
| Anthropic, PBC | Bonnie AI cognitive assistant processing (contract drafting, CRM intelligence, autonomous workflows). No customer data is used to train foundation models. | User prompts, selected workspace contexts submitted for AI generation. | United States | Anthropic Commercial Terms, EU SCCs, Zero Data Retention for Model Training |
| OpenAI, LLC | Secondary LLM synthesis, text embeddings, and semantic vector operations. | Prompt text, embeddings indices. | United States | OpenAI Business Terms, Zero Data Retention / No Training Policy, EU SCCs |
| DeepSeek Technologies Co., Ltd. | Specialized code generation, technical analysis, and structured reasoning engines. | Transient code snippets and structured query templates. | Global API Gateways | API Enterprise Agreement, Ephemeral Processing |
| Stripe, Inc. | Subscription payment processing, invoice checkout, and fraud monitoring. | Billing addresses, payment methods, transaction receipts. | United States and EU | PCI-DSS Level 1 Service Provider, Stripe DPA, EU SCCs |
| Brevo SAS (formerly Sendinblue) | Transactional email delivery, password resets, signature notifications, and data subject request receipts. | Recipient email addresses, notification subject lines, email delivery logs. | European Union (France / Germany) | EU GDPR Native Compliance, Brevo DPA |
| Functional Software, Inc. (Sentry) | Application error logging, crash diagnostics, and performance monitoring. | Client stack traces, browser user-agent, error metadata (PII scrubbed by default). | United States | EU Standard Contractual Clauses (SCCs), Sentry DPA |
Last audited and published: October 1, 2026