Sub-processors
Effective 25 June 2026 · version 1.0 (draft)
Exec X AI Ltd engages the third-party processors below to deliver the service. Each is bound by a written agreement no less protective than our data processing addendum (Article 28 of the GDPR). We give prior notice of material changes; customers may object by writing to privacy@regulation10.com.
1. Current sub-processors
| Sub-processor | Purpose | Region | Transfer mechanism | Applies to |
|---|---|---|---|---|
| Microsoft Azure | Hosting, compute, Cosmos DB, WORM blob storage, and AI inference (Azure OpenAI) | Sweden Central (EU data boundary), for data at rest and for inference | Processing within the EU and EEA; EU standard contractual clauses (Article 46) for any onward transfer | Platform |
| Opus (AppliedAI) | AI agent orchestration layer for the ASO assistant | UAE region | EU standard contractual clauses (Article 46) plus a transfer impact assessment. The UAE is not the subject of an EU adequacy decision | Platform |
| Stripe | Subscription billing and payment processing | United States and EU | EU standard contractual clauses (Article 46) plus the Stripe data processing agreement | Platform |
| Resend | Transactional and notification email delivery | United States and EU | EU standard contractual clauses (Article 46) plus the provider data processing agreement | Both |
| Vercel | Marketing-site hosting and CDN | Global edge | EU standard contractual clauses (Article 46) plus the provider data processing agreement | Marketing |
| Plausible Analytics | Cookieless, aggregate web analytics on the marketing site, no cross-site identifiers | EU | Processing within the EU; no personal data collected | Marketing |
2. How to read this register
“Platform” entries process authenticated customer data on regulation10.com. “Marketing” entries process enquiry and analytics data from our public marketing site. “Both” entries do each.
Tenant data is resident in the Azure Sweden Central region, inside the EU data boundary. AI inference for the platform runs in the same region.
This register is a disclosure of actual data flows. A vendor we do not send data to is not listed, and any new flow to a new vendor is added here before the flow starts. See our privacy policy for the full residency and transfer position.
3. Objecting to a change
If you object to a new sub-processor, write to privacy@regulation10.com within the notice period stated in your agreement, setting out the grounds of your objection.