Subprocessors
Data Processing Addendum Annex 2, version 1.4. Last updated September 4, 2026.
Subprocessors SystemPath engages, or may engage, to Process Customer Data as of the Last updated date shown at the top of this Addendum. A listed Subprocessor is not necessarily active for every customer or feature. Changes are governed by Section 4 and Agreement §19.3. Application logs, error monitoring, AI request tracing, and search indexes are self-hosted within SystemPath's AWS environment and involve no additional vendor. The current list and change notifications are published at https://systempath.com/legal/subprocessors, which supplements the email notice in Section 4.2.
SystemPath gives customers at least 30 days' prior written notice by email to the notice address in the Order Form before engaging a new subprocessor. This subscription supplements that email and does not replace it. Customers may object on reasonable data protection grounds during that period under Agreement §19.3.
Infrastructure and platform operations
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Amazon Web Services, Inc. | Cloud hosting, compute, database, object storage, search indexing, and outbound email delivery (SES) | All Customer Data | United States |
| Cloudflare, Inc. | Content delivery, DNS, TLS termination, and web application firewall | Data in transit; request metadata | United States / global edge |
AI and machine learning
Content submitted to AI-enabled features may be transmitted to the providers below. Each is subject to the no-training commitments in Agreement §13.4: Customer Data is not used to train any shared or cross-customer model, and there is no cross-tenant learning.
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Anthropic, PBC | Large language model inference for AI-enabled features | Content submitted to AI features | United States |
| OpenAI, L.L.C. | Large language model inference for AI-enabled features | Content submitted to AI features | United States |
| Google LLC | Large language model inference (Gemini) for AI-enabled features | Content submitted to AI features | United States |
| Voyage AI | Text embedding generation for semantic search and retrieval | Text submitted for indexing | United States |
Operations and billing
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Stripe, Inc. | Payment processing and subscription billing | Billing contact and payment data. No food safety or quality records. SystemPath does not store full payment card numbers. | United States |
| Twilio Inc. | SMS notification delivery and telephone number verification | Sender and recipient telephone numbers; SMS message content and replies; message identifiers and delivery-status metadata | United States, subject to carrier routing |
| Google LLC (Workspace, Firebase Cloud Messaging) | Support and implementation communications (email, file sharing, video calls); push notification delivery to Android and web devices | Support communications and attachments, which may contain Customer Data; FCM device tokens; notification titles, body text, and payload data, including record identifiers | United States and other Google facilities; FCM is a global service |
| Apple Inc. | Mobile push notification delivery to iOS devices (Apple Push Notification service) | Device tokens; notification titles, body text, and payload data, including record identifiers | Global |
Get change notifications
Enter your name and email to receive notices when this list changes.
Send legal questions to [email protected].