Sub-processors
[Legal entity name] (“Asteryx”) uses the following third parties to process customer personal data on your behalf. Each is bound by a written agreement with data-protection obligations at least as protective as our Data Processing Addendum. We give at least 30 days' notice before adding or replacing a sub-processor; write to privacy@asteryx.io to subscribe to notices or to object.
| Sub-processor | Purpose | Personal data | Location | Used |
|---|---|---|---|---|
| Supabase, Inc. | Database, authentication, file storage (receipts, invoices, audit archives) | All customer data | [Primary data region, e.g. AWS ap-south-1 (Mumbai)] | Always |
| Netlify, Inc. | Application hosting and content delivery | Request metadata (IP address, user agent) in transit; no data at rest | Global edge network | Always |
| Resend, Inc. | Transactional email (invitations, notifications, quotes, invoices) | Recipient email, message content | United States | When email is enabled |
| Twilio Inc. | SMS / WhatsApp notifications to travel vendors | Vendor phone number, request summary | United States | When SMS / WhatsApp is enabled |
| Functional Software, Inc. (Sentry) | Error monitoring | Error context; may include a user identifier or email | United States | When monitoring is enabled |
| AI model provider configured by Asteryx (e.g. Anthropic, PBC) | Optional AI assistants (trip / expense drafting, receipt reading, Q&A) | The text or receipt image a user submits to an assistant; organization data summaries for Q&A | United States | Only for organizations with AI features enabled |
Travel vendors that receive your trip requests in the product (including the default travel vendor) process the trip details needed to quote and book travel for you, under their own terms.