Legal

Sub-processors

Last updated: 2 May 2026

Aucava gives customers at least 30 days' notice by email before adding a new sub-processor to this list. Existing customers can subscribe to change notifications through their account manager, or by emailing privacy@aucava.ai.

Amazon Web Services, Inc.

Purpose: Hosting, storage, compute
Data category: All tenant operational data
Location: UK and EU (London primary, Dublin backup). Optional US regions only with explicit tenant opt-in.

Amazon Bedrock

Purpose: Managed AI inference for product features
Data category: Prompts and responses (contain tenant business content by design)
Location: UK / EU

Pipedream, Inc. (a Workday company)

Purpose: Managed OAuth and third-party connector orchestration
Data category: Tenant OAuth tokens and intermediate API payloads
Location: UK / EU. US fallback only with explicit tenant consent.

Vercel, Inc.

Purpose: Marketing site hosting and cookieless analytics
Data category: Aggregated page-view data; no personal identifiers
Location: Global edge; analytics aggregation in the United States

Stripe, Inc.

Purpose: Billing and payment processing
Data category: Tenant billing contact and payment method token
Location: United States (with Standard Contractual Clauses)

Google LLC

Purpose: (a) Our own Google Workspace (email and calendar); (b) Google Workspace APIs when a tenant explicitly connects an account
Data category: Tenant email and document content when a tenant explicitly authorises connection
Location: Google's regions

Microsoft Corporation

Purpose: Microsoft 365 APIs when a tenant explicitly connects an account
Data category: Tenant email, calendar, and document content when a tenant explicitly authorises connection
Location: Microsoft 365 region of the tenant

Slack Technologies LLC (a Salesforce company)

Purpose: Slack events and messages for the Aucava Slack app, scoped by the customer workspace admin
Data category: Slack events the workspace admin has authorised the Aucava app to receive
Location: Slack's regions

Sub-processor	Purpose	Data category	Location
Amazon Web Services, Inc.	Hosting, storage, compute	All tenant operational data	UK and EU (London primary, Dublin backup). Optional US regions only with explicit tenant opt-in.
Amazon Bedrock	Managed AI inference for product features	Prompts and responses (contain tenant business content by design)	UK / EU
Pipedream, Inc. (a Workday company)	Managed OAuth and third-party connector orchestration	Tenant OAuth tokens and intermediate API payloads	UK / EU. US fallback only with explicit tenant consent.
Vercel, Inc.	Marketing site hosting and cookieless analytics	Aggregated page-view data; no personal identifiers	Global edge; analytics aggregation in the United States
Stripe, Inc.	Billing and payment processing	Tenant billing contact and payment method token	United States (with Standard Contractual Clauses)
Google LLC	(a) Our own Google Workspace (email and calendar); (b) Google Workspace APIs when a tenant explicitly connects an account	Tenant email and document content when a tenant explicitly authorises connection	Google's regions
Microsoft Corporation	Microsoft 365 APIs when a tenant explicitly connects an account	Tenant email, calendar, and document content when a tenant explicitly authorises connection	Microsoft 365 region of the tenant
Slack Technologies LLC (a Salesforce company)	Slack events and messages for the Aucava Slack app, scoped by the customer workspace admin	Slack events the workspace admin has authorised the Aucava app to receive	Slack's regions

Questions about this list or our broader privacy programme: privacy@aucava.ai. For a copy of our current Data Processing Agreement, see /dpa.