AdaptivMapr engages a small set of carefully-selected vendors (“subprocessors”) to deliver the Services. This page lists every vendor that processes customer data — what they do, where the data lives, and the legal posture (BAA, DPA, or scope exclusion) we rely on. Two rows are model providers reached through phi-cloud; they are listed separately because they receive the content of the calls they answer. The list is referenced from the AdaptivMapr DPA, Security overview, and Privacy Policy.
1. Current subprocessors
One row is marked (first-party infrastructure). It is not a vendor and involves no onward transfer: it is hardware AdaptivMapr owns and operates, listed here because this table is where data residency is read and because that one processing step does not run on any of the platforms around it. What it receives is stated in full in its row — column names and computed profiles, never cell values.
| Vendor | Role | Region / data residency | BAA / DPA status |
|---|---|---|---|
| Cloudflare | Runs the whole application: Workers compute (the API, which the MCP server calls, and the dashboard), KV (parsed uploads for the workspace retention window, webhook secrets and delivery records, quota and cache entries), Queues (webhook delivery), Workers Logs and Analytics Engine (operational events and scrubbed browser error reports — ids and metadata, no file content), DNS, DDoS protection, edge cache, and the private tunnel to our own mapping-ranker host. | Global network; requests are served from the data centre nearest the caller | BAA available on the Cloudflare Enterprise plan (contract-dependent — see §2) |
| Supabase | Postgres database and sign-in (Supabase Auth): accounts, workspace settings and members, a mirror of each upload for its retention window (the clamped sample in schema-only mode, full rows in full-data mode), saved schemas, mappings, layouts and reshape programs, remembered chats and their files, the audit log, the billing ledger, signed agreements and policy acceptances, rate-limit counters, and the prompt-injection signal log. | Switzerland — Zurich (AWS eu-central-2). One project for every workspace: the workspace region setting does not move it. | BAA available with the Supabase HIPAA add-on (Team and Enterprise plans) (contract-dependent — see §2) |
| phi-cloud | Model gateway (OpenAI-compatible, PHI-aware) for every model call except the mapping ranker: the mapping model (cascade layer 5), structural-reshape code generation and the sandbox that runs the generated program over the data, document and image extraction for convert, and the Chat assistant. It forwards each call to a model provider chosen by routing: PHI-routed calls only to PHI-eligible providers resident in the pinned region (currently Infomaniak in Switzerland, Scaleway in the EU, Microsoft Azure in CH/EU/US — which also does layout OCR for PDFs — and, once activated, Fireworks in the US); standard calls to the general models listed in the next two rows. Its own provider list is published at phi-cloud.com/legal/sub-processors. | Per the workspace region (CH, EU, UK or US) for PHI-routed calls; standard calls run where the chosen general model runs | Operated by the same operator as AdaptivMapr. BAAs are in place with the providers it uses for PHI-routed calls. (contract-dependent — see §2) |
| Inception Labs (via phi-cloud) | The default general-purpose model (Mercury 2) for STANDARD-routed calls: Chat replies and routing, and the mapping model on a standard run. Receives the prompt for that call — on a schema-only map, column headers and at most three sample values of at most 80 characters each. | United States | Standard (non-PHI) traffic only — a PHI-routed call never reaches it. |
| Z.ai / Zhipu AI (via phi-cloud) | General-purpose models (GLM-5.3 and GLM-5.3-Flash) for STANDARD-routed calls that need more capability: one-off pieces of work and code generation for structural reshape. Receives the prompt for that call. | Worldwide — the provider does not offer a region-resident endpoint | Standard (non-PHI) traffic only — a PHI-routed call never reaches it. |
| AdaptivMapr mapping ranker | Mapping ranker (cascade layer 3½): scores each still-unresolved column against the fields of the target schema. Receives column NAMES and a statistical profile computed in the Worker (value kind, length range, uniqueness, letter case, share of empty cells). Never receives a cell value, a row or a file. | Switzerland — our own hardware, reached over a private Cloudflare tunnel. Used for workspaces pinned to CH or with no pin. | Not a third party: no vendor, no onward transfer. (first-party infrastructure) |
| RunPod | Failover GPU for the mapping ranker — the same model, used only when our Swiss hardware is unreachable. Receives exactly what the ranker receives (column names and the computed profile, never a cell value). Processed in memory, not stored. | EU data centres only. Used only for workspaces with no region pin; never for a CH, EU, UK or US pin. | RunPod Data Processing Addendum. No cell values reach it. (contract-dependent — see §2) |
| Monopea | Spreadsheet macro editing (Chat asks to write or change VBA), and structural-reshape code generation when that provider is enabled. A macro edit sends the WHOLE workbook: it is stored in Monopea’s document library for the duration of the edit and deleted there when the edited file comes back. The workspace’s PHI flag and region travel with every request. | Fly.io infrastructure; Monopea’s own model calls go through phi-cloud with the forwarded region, but the Monopea host is not region-pinned | Operated by the same operator as AdaptivMapr. Fly.io is the hosting provider underneath. (contract-dependent — see §2) |
| Stripe | Wallet top-ups, the monthly plan, invoices, payment processing and the customer portal. Receives billing name, email, address, VAT number and card details (which we never see). | Ireland (Stripe Payments Europe), with US affiliates | No customer records reach it. Stripe DPA with Standard Contractual Clauses. |
| Resend | All email we send: sign-in links and codes (Supabase Auth uses Resend as its mail relay), transactional email (welcome, billing, quota, destructive-action notices) and support requests, which are forwarded as ordinary email to our support mailbox. Receives the recipient address and the message. | The Resend sending region configured for our domain (Resend operates in the US and other regions) | No customer records are put in our email templates. A support request carries whatever the sender typed — the form asks for no patient information. Resend DPA. |
| Sign in with Google (Google Identity Services). Google learns that you signed in to AdaptivMapr; we receive your Google account email and basic profile. Nothing you upload is sent to Google. | Google global infrastructure | Only for people who choose Google sign-in. |
2. Contract-dependent coverage
Rows flagged (contract-dependent — see §2) are vendors whose HIPAA coverage exists only while an upstream agreement or plan is in force. The product does not switch it on or off, and this page does not assert it:
- Cloudflare. Cloudflare offers a HIPAA Business Associate Agreement on its Enterprise plan. Every request — including a full-data upload — runs on Cloudflare Workers and is held in KV for the workspace retention window.
- Supabase. Supabase offers a BAA with its HIPAA add-on on the Team and Enterprise plans. The database holds full-data upload mirrors, remembered chats and the audit log.
- phi-cloud. phi-cloud holds BAAs with the model providers it uses for PHI-routed calls. Standard-routed calls go to the general model providers listed above, which are not under a BAA and never receive a call marked as PHI.
- Monopea and RunPod. Both run on infrastructure rented from another provider (Fly.io for Monopea; RunPod's own data centres), so their coverage follows those providers' terms. Monopea receives whole workbooks for macro edits with the workspace's PHI flag forwarded; RunPod receives no cell values.
If you are evaluating AdaptivMapr for a HIPAA-regulated workload, request the deployment certificate at compliance@adaptivmapr.com — it states which of these agreements are in force for the production deployment on the date it is issued.
3. Notice of new or replaced subprocessors
We announce a new or replacement subprocessor on this page at least 30 days before it starts processing customer data, and email the announcement to every workspace under a signed BAA and to anyone subscribed below. You may object to a new subprocessor in writing within 30 days of the notice on reasonable data-protection grounds; if we cannot resolve the objection in good faith, you may terminate the affected portion of the Services without penalty and receive a pro-rata refund of any prepaid fees.
To subscribe to subprocessor change notifications, email compliance@adaptivmapr.com with your workspace name and a contact address.
4. Out of scope
The following providers handle AdaptivMapr operational data but do not process customer-submitted records or PHI, and are not subprocessors within the meaning of GDPR Art. 28 or the HIPAA Rules:
- Source control & CI/CD — GitHub, for the source tree, dependency alerts and build pipelines. No customer data.
- Error reporting — No third-party error tracker. Server errors and scrubbed browser error reports go to Cloudflare Workers Logs and Analytics Engine (the Cloudflare row above) — route, error type and ids, never file content, form values or IP addresses.
- Status page — adaptivmapr.com/status, served by this application, for incidents and maintenance.
Not in use, and therefore not listed: an embeddings provider for the cascade's semantic layer (switched off in production) and any external audit-log service. Turning either on would add a row here, with the notice described in §3, before any data reached it. The systems you connect yourself — a CRM, a bucket, a spreadsheet, a webhook endpoint — are your own vendors, read from or written to on your instruction.
5. Contact
Compliance and subprocessor questions: compliance@adaptivmapr.com. Data-protection requests: dpo@adaptivmapr.com. Security disclosures: security@adaptivmapr.com.