Vendors & subprocessors
The infrastructure this product runs on
11 subprocessors process data for this product. 6 can receive record content, 2 receive only column names and computed statistics, and 3 receive no customer records at all. This page says which is which, in a table, without you reading a contract first.
Subprocessors
Every vendor that can touch customer data
A subprocessor within the meaning of GDPR Article 28 and the HIPAA Rules. Region is where the workload runs, not where the company is incorporated.
| Vendor | Region | Customer records? |
|---|---|---|
| CloudflareRuns the whole application: Workers compute (the API, which the MCP server calls, and the dashboard), KV (parsed uploads for the workspace retention window, webhook secrets and delivery records, quota and cache entries), Queues (webhook delivery), Workers Logs and Analytics Engine (operational events and scrubbed browser error reports — ids and metadata, no file content), DNS, DDoS protection, edge cache, and the private tunnel to our own mapping-ranker host.BAA available on the Cloudflare Enterprise planContract-dependent | Global network; requests are served from the data centre nearest the caller | Record content can reach it |
| SupabasePostgres database and sign-in (Supabase Auth): accounts, workspace settings and members, a mirror of each upload for its retention window (the clamped sample in schema-only mode, full rows in full-data mode), saved schemas, mappings, layouts and reshape programs, remembered chats and their files, the audit log, the billing ledger, signed agreements and policy acceptances, rate-limit counters, and the prompt-injection signal log.BAA available with the Supabase HIPAA add-on (Team and Enterprise plans)Contract-dependent | Switzerland — Zurich (AWS eu-central-2). One project for every workspace: the workspace region setting does not move it. | Record content can reach it |
| phi-cloudModel gateway (OpenAI-compatible, PHI-aware) for every model call except the mapping ranker: the mapping model (cascade layer 5), structural-reshape code generation and the sandbox that runs the generated program over the data, document and image extraction for convert, and the Chat assistant. It forwards each call to a model provider chosen by routing: PHI-routed calls only to PHI-eligible providers resident in the pinned region (currently Infomaniak in Switzerland, Scaleway in the EU, Microsoft Azure in CH/EU/US — which also does layout OCR for PDFs — and, once activated, Fireworks in the US); standard calls to the general models listed in the next two rows. Its own provider list is published at phi-cloud.com/legal/sub-processors.Operated by the same operator as AdaptivMapr. BAAs are in place with the providers it uses for PHI-routed calls.Contract-dependent | Per the workspace region (CH, EU, UK or US) for PHI-routed calls; standard calls run where the chosen general model runs | Record content can reach it |
| Inception Labs (via phi-cloud)The default general-purpose model (Mercury 2) for STANDARD-routed calls: Chat replies and routing, and the mapping model on a standard run. Receives the prompt for that call — on a schema-only map, column headers and at most three sample values of at most 80 characters each.Standard (non-PHI) traffic only — a PHI-routed call never reaches it. | United States | Record content can reach it |
| Z.ai / Zhipu AI (via phi-cloud)General-purpose models (GLM-5.3 and GLM-5.3-Flash) for STANDARD-routed calls that need more capability: one-off pieces of work and code generation for structural reshape. Receives the prompt for that call.Standard (non-PHI) traffic only — a PHI-routed call never reaches it. | Worldwide — the provider does not offer a region-resident endpoint | Record content can reach it |
| AdaptivMapr mapping rankerMapping ranker (cascade layer 3½): scores each still-unresolved column against the fields of the target schema. Receives column NAMES and a statistical profile computed in the Worker (value kind, length range, uniqueness, letter case, share of empty cells). Never receives a cell value, a row or a file.Not a third party: no vendor, no onward transfer. | Switzerland — our own hardware, reached over a private Cloudflare tunnel. Used for workspaces pinned to CH or with no pin. | Metadata only |
| RunPodFailover GPU for the mapping ranker — the same model, used only when our Swiss hardware is unreachable. Receives exactly what the ranker receives (column names and the computed profile, never a cell value). Processed in memory, not stored.RunPod Data Processing Addendum. No cell values reach it.Contract-dependent | EU data centres only. Used only for workspaces with no region pin; never for a CH, EU, UK or US pin. | Metadata only |
| MonopeaSpreadsheet macro editing (Chat asks to write or change VBA), and structural-reshape code generation when that provider is enabled. A macro edit sends the WHOLE workbook: it is stored in Monopea’s document library for the duration of the edit and deleted there when the edited file comes back. The workspace’s PHI flag and region travel with every request.Operated by the same operator as AdaptivMapr. Fly.io is the hosting provider underneath.Contract-dependent | Fly.io infrastructure; Monopea’s own model calls go through phi-cloud with the forwarded region, but the Monopea host is not region-pinned | Record content can reach it |
| StripeWallet top-ups, the monthly plan, invoices, payment processing and the customer portal. Receives billing name, email, address, VAT number and card details (which we never see).No customer records reach it. Stripe DPA with Standard Contractual Clauses. | Ireland (Stripe Payments Europe), with US affiliates | No customer records |
| ResendAll email we send: sign-in links and codes (Supabase Auth uses Resend as its mail relay), transactional email (welcome, billing, quota, destructive-action notices) and support requests, which are forwarded as ordinary email to our support mailbox. Receives the recipient address and the message.No customer records are put in our email templates. A support request carries whatever the sender typed — the form asks for no patient information. Resend DPA. | The Resend sending region configured for our domain (Resend operates in the US and other regions) | No customer records |
| GoogleSign in with Google (Google Identity Services). Google learns that you signed in to AdaptivMapr; we receive your Google account email and basic profile. Nothing you upload is sent to Google.Only for people who choose Google sign-in. | Google global infrastructure | No customer records |
Out of scope
Operational vendors that see no customer data
Named here for completeness. These are not subprocessors within the meaning of GDPR Article 28 or the HIPAA Rules, and are listed as such in /legal/subprocessors §4.
Source control & CI/CD
GitHub, for the source tree, dependency alerts and build pipelines. No customer data.
Error reporting
No third-party error tracker. Server errors and scrubbed browser error reports go to Cloudflare Workers Logs and Analytics Engine (the Cloudflare row above) — route, error type and ids, never file content, form values or IP addresses.
Status page
adaptivmapr.com/status, served by this application, for incidents and maintenance.
Changes
How you hear about a new one
Adding or replacing a subprocessor is a change to the DPA, not a silent config edit. The notice period, the objection right and the mechanism are all stated in the DPA rather than on this page, because that is where they are binding.
Send the questionnaire. We answer in writing.
A BAA, the HIPAA security risk assessment, the DPA and the subprocessor list are all available on request — and most of what a reviewer asks is already on this site.