We notify customers by email at least thirty (30) days before engaging a new sub-processor that processes Customer Personal Data, so you always have time to review. This list is referenced by our Data Processing Agreement and our Privacy Notice.
| Sub-processor | Purpose | Region | Data categories |
|---|---|---|---|
| Supabase, Inc. | Database, storage, authentication, edge functions, realtime | United States by default (region pinned per your Order Form) | All data categories |
| Vercel, Inc. | Frontend hosting | Global (edge network) | HTTP request metadata only |
| Modal Labs, Inc. | Self-hosted AI inference compute (runs our own model). Zero data retention: prompts and responses are in-flight only and never written to disk. SOC 2 Type II. | United States (compute region pinned) | AI prompt and response text, in-flight only, never retained |
| Resend, Inc. | Transactional email | United States | Recipient email, subject, and body of notifications |
| Twilio, Inc. (optional) | Operator SMS for help-desk tickets | United States | Operator phone numbers and message text (no customer PII) |
No third-party AI vendor. Our AI inference runs on a model we operate ourselves, on stateless GPU compute (Modal) under zero data retention. No outside AI company sees, stores, or trains on your data. Modal appears above as infrastructure that runs our model, not as an AI vendor that uses your data.
How we keep this list honest
This page is verified against the services actually deployed, not maintained by hand alone. When a provider is added or removed, this list and the 30-day customer notice are updated together. We do not add a provider quietly.
Questions
To ask about a sub-processor, request the underlying agreements, or raise a concern, email privacy@athenaforms.ai.
Version 1.1
Updated 26 June 2026
Owner Elemental Insights LLC