Current version, effective 2026-10-22 · All versions
Sub-Processors
Update policy: Customers will be notified at least 30 days before a new Sub-Processor begins processing Personal Data on Customer's behalf.
Terms defined in the Terms of Service (for self-serve subscriptions) or Subscription Agreement (for sales-assisted subscriptions), the Data Processing Agreement, and the Data Handling Terms, have the same meaning in this document.
What is a Sub-Processor?
A Sub-Processor is a third-party service that processes Personal Data on Customer's behalf under the Data Processing Agreement. NeoSpline also uses service providers for NeoSpline Controller Data as described in the Privacy Policy; those providers are not listed here unless they also process Personal Data on Customer's behalf. Several providers below process data in a dual role: they are listed as Sub-Processors to the extent they process Personal Data on Customer's behalf, and they may separately process NeoSpline Controller Data as described in the Privacy Policy.
Active Sub-Processors
Infrastructure and Core Services
| Sub-Processor | Purpose | Data Processed | Processing Location | Third-country transfer |
|---|---|---|---|---|
| Amazon Web Services (AWS) | Infrastructure, web/API hosting, database hosting, backup storage | Product Account Data, Customer Content, Processing Data, Voice Input | EU (default); Enterprise customers choose Designated Region (EU or US) | No (EU default); Yes — DPF/SCCs (US Designated Region) |
| Auth0 (Okta) | Authentication and authorization for plugin, web platform, API clients, SSO, SCIM | Authentication Data (as defined in the Data Handling Terms) | EU | Yes — DPF/SCCs |
| BetterStack | Application/API logging and monitoring | Service Data (operational log metadata: correlation identifiers, security events, API request metadata, IP addresses; no Customer Content, Processing Data, or Product Account Data) | EU | No |
| Mailgun (Sinch) | Transactional email and service notifications | Service Data (transactional email content and delivery metadata: recipient email address, organization name, and sign-in, verification, and password-reset links; message bodies retained by Mailgun up to 72 hours) | EU | Yes — DPF/SCCs |
AI Inference
NeoSpline uses AI model providers to process Customer Content for the purpose of delivering AI-assisted design features.
| Sub-Processor | Purpose | Data Processed | Processing Location | Provider-side Retention | Third-country Transfer |
|---|---|---|---|---|---|
| Amazon Web Services (AWS Bedrock) | AI inference for AI-assisted design features | Customer Content, Processing Data | No guaranteed region (standard-tier); Designated Region (enterprise) | Inputs and outputs retained up to 30 days for abuse monitoring | Yes — DPF/SCCs |
| Anthropic PBC | AI inference via the Anthropic API for AI-assisted design features | Customer Content, Processing Data | Global (no guaranteed region) | Inputs and outputs retained up to 30 days for abuse monitoring | Yes — SCCs |
| Microsoft Azure | AI inference for AI-assisted design features | Customer Content, Processing Data | No guaranteed region (standard-tier); Designated Region (enterprise) | Inputs and outputs retained up to 30 days for abuse monitoring | Yes — DPF/SCCs |
| OpenAI | Voice Input transcription only | Voice Input | Global (no guaranteed region) | None for /v1/audio/transcriptions, as described in OpenAI's API data controls (opens in a new tab) | Yes — SCCs |
All AI providers are bound by Data Processing Agreements and are contractually prohibited from using any data received from NeoSpline for model training — see the Data Handling Terms.
Transfer Safeguards
Where a sub-processor is marked as involving a third-country transfer, NeoSpline relies on one or more of the following lawful transfer mechanisms:
- EU Standard Contractual Clauses (SCCs) — Commission Implementing Decision (EU) 2021/914. Module 3 (Processor to Sub-Processor) applies where NeoSpline processes Personal Data on behalf of customers; Module 2 (Controller to Processor) applies where NeoSpline is the Data Controller.
- EU-U.S. Data Privacy Framework (DPF) — where the importer is self-certified under the DPF (verified at dataprivacyframework.gov (opens in a new tab)), including the UK Extension where applicable.
- UK International Data Transfer Addendum to the EU SCCs or another UK-approved transfer mechanism — for UK Personal Data, where applicable.
Billing
| Sub-Processor | Purpose | Data Processed | Processing Location | Third-country transfer |
|---|---|---|---|---|
| Stripe | Payment processing and subscription billing | Payment data and subscription billing records | EU | Yes — DPF/SCCs |
Stripe processes payment data on NeoSpline's behalf (as a processor) and also acts as an independent controller for fraud prevention, anti-money laundering compliance, and regulatory obligations — see Stripe's DPA (opens in a new tab).
Customer Support and Feedback Management
| Sub-Processor | Purpose | Data Processed | Processing Location | Third-country transfer |
|---|---|---|---|---|
| Intercom | Customer support messaging and helpdesk | Support conversations relating to the Services, including authorized-user contact details and identifiers, and any Customer Content or Personal Data included in support requests | US | Yes — DPF/SCCs |
Intercom is listed as a Sub-Processor to the extent support conversations contain Personal Data processed on Customer's behalf. NeoSpline separately processes support, feedback, CRM, and business contact records, including support conversation records held in its internal tools, as Data Controller, as described in the Privacy Policy.
Supplier Security Standard
NeoSpline assesses each Sub-Processor's security posture before engagement and on an ongoing basis. Sub-Processors are assessed for, and where applicable hold, recognized security certifications such as ISO 27001 or SOC 2 Type II. Current certification status per provider is available on request at security@neospline.ai.
How to Object
If you object to a new sub-processor, notify us within 30 days of our notification at privacy@neospline.ai. We will work with you to find an alternative arrangement or, if no resolution is possible, you may terminate the affected services per the DPA.