Sub-processors

Who this is for:an agency's legal or procurement team deciding whether to sign, and any customer who wants to know exactly which companies touch their data before they trust us with a client.

Last verified: 2026-08-23.Every “what it receives” statement below was checked against the source code on that date, not inferred from a vendor's marketing page. Where a fact could not be verified from the code, this page says so in place of the fact.

1. How to read this page

Apex plays two roles, and the distinction decides which column matters to you.

• For your agency's own account data (your logins, your billing, your team) Apex is the controller.
• For your clients' end-consumer data (the people who fill in a form on your client's website) Apex is a processor. Your client is the controller. You and your client decide the purpose. We follow it.

Every company below is a sub-processor in the second sense only where the “consumer personal data” column says so. Several receive nothing but Apex's own operating data and are listed anyway, because a partial list is worse than none.

The companion record of processing, docs/ops/processing-records.md, carries the file-and-line evidence behind every claim on this page.

2. What the AI assistants Apex measures do and do not receive

Agencies ask this before anything else, so it comes before the list.

Apex measures ChatGPT, Gemini, Claude and Perplexity. They are not sub-processors of your clients' consumer data.

Here is the actual mechanic. Each client has a tracked question bank: a curated set of questions a real customer might ask an assistant, such as “who does emergency water damage restoration in Fort Collins”. The nightly measurement run sends those questions, and nothing else, to each assistant, along with an approximate market pin (city, region, country) taken from the client's own service area and business address. It records what came back: was the client named, which pages were cited, which competitors appeared.

What is sent is a question about a business. Not a person.

Two facts make this a structural property rather than a policy we promise to follow:

• The questions come from site_config.aeo_queries, the client's own tracked bank, and from nowhere else (apps/portal/lib/server/visibility/run.ts:470). There is no code path that puts a consumer's words into a measurement query.
• The lead-capture pipeline cannot reach an AI provider at all. A test walks the import graph from every file in the repository that holds a lead's own words and fails the build if any of them can reach a model provider (apps/portal/lib/server/lead/__tests__/no-llm.test.ts). It is enforced on every commit, not reviewed once.

So when a lead arrives and Apex tells your client “this person came from ChatGPT”, nothing about that person was sent to ChatGPT. The connection is made on our side, by joining the page they landed on to citations we already recorded for that page. The evidence attached to a lead is a list of the client's own tracked questions and how often each one produced a citation (packages/core/src/lead-intent.ts:100-103).

One exception, and it is a different feature. Apex has an SMS assistant that drafts replies to text messages. Where a client turns it on, a consumer's own message text is sent to Anthropic on purpose, because drafting a reply to a message requires reading the message. That is disclosed in the table below as consumer data going to Anthropic. It is not lead capture, and the SMS track is not currently sold: the A2P carrier campaign never cleared and no client is on it today. The code path is intact and would run the moment a conversation existed, which is why it is disclosed rather than omitted.

3. The sub-processor list

3.1 Infrastructure

Supabase, Inc. (United States)

Every table carries Row Level Security, verified 32 of 32 against the live database on 2026-08-15, so one agency's rows are not reachable by another even inside the same database.

Vercel Inc. (United States)

3.2 Delivery and messaging

Resend (United States, operated by Plus Five Five, Inc.)

One qualifier worth stating rather than leaving to be discovered: the “no phone or email in this email” guarantee is about the shapeof the message, not its contents. A phone number typed into a badly labelled “name” box would appear in the subject line, and a free-text message can contain anything a person chose to type.

Twilio Inc. (United States). Has received consumer data. Not in use today.

3.3 Operations and reliability

Upstash, Inc. (United States)

The second door, the webhook door for form builders that cannot run the snippet, keys on a hash of the webhook secret and sends no personal data at all.

Sentry (United States, operated by Functional Software, Inc.)

Inngest, Inc. (United States)

Better Stack

Cloudflare, Inc. (United States)

3.4 Billing

Stripe, Inc. (United States)

3.5 AI processing

Anthropic PBC (United States)

Anthropic appears here for two distinct reasons, and only one of them involves a consumer.

Google LLC (United States), OpenAI, L.L.C. (United States), and Perplexity AI, Inc. (United States)

3.6 Business data sources

Google LLC (Places API) and Foursquare Labs, Inc. (Places API)

3.7 Apex's own business operations

These handle Apex's data about its customers and prospects. They never receive a client's end-consumer data.

3.8 Listed for completeness, not sub-processors

GitHub, Inc.hosts the source code and runs continuous integration. It holds no customer or consumer personal data. It is named here because procurement teams ask, and “not on the list” reads worse than “on the list with the reason”.

4. International transfers

All personal data is stored in the United States. Apex does not offer EU data residency today, and no statement on this page should be read as implying one. The database runs in us-west-2, verified live on 2026-08-23.

Apex has no establishment in the European Union and does not target EU data subjects. The realistic EU exposure is a European visitor filling in a form on a US client's website. In that case:

• Apex acts as processor. The client is the controller and is the party making the transfer decision.
• Apex's Data Processing Agreement incorporates the Standard Contractual Clauses, Module Three (processor to sub-processor), where a client requires them.
• The sub-processors above are US entities contracting on the basis of Standard Contractual Clauses, the EU-US Data Privacy Framework, or both.

On Data Privacy Framework certification: several of the companies above publish a current certification, and several do not. This page deliberately does not assert any individual vendor's certification status, because that status changes without notice and a stale claim in a published document is worse than no claim. Confirming each vendor's current status at the moment of signature is an item for counsel, and each vendor's live entry on the official Data Privacy Framework list is the authority, not this page.

5. Sub-processor changes and your right to object

Apex commits to the following, and it applies to every customer on every plan.

Notice. Before a new sub-processor begins processing customer or consumer personal data, Apex will give 30 days' written notice, sent by email to each customer's account contact and published as a dated revision to this page.

What the notice contains. The same facts every entry above carries: the legal entity, what it will do, the categories of personal data it can receive, where it processes, and the transfer mechanism. Not a name and a link.

Objection. A customer may object to a new sub-processor, in writing to privacy@apexdiscover.ai, within the 30-day notice period, on reasonable grounds relating to data protection. Apex will work with the customer in good faith to find an alternative. Where no alternative can be found, the customer may terminate the affected subscription without penalty and receive a pro-rata refund of any prepaid, unused fees.

The exception, stated up front rather than buried. Where a sub-processor must be replaced urgently for security, legal, or availability reasons, Apex will make the change and give notice as soon as it reasonably can, rather than waiting out 30 days while the service is at risk. The objection right survives the change.

Watching this page.This document lives in the platform's own repository and every revision is dated. Customers who want the change history rather than the current state can ask for it at privacy@apexdiscover.ai.

6. Contact

Related documents: the Data Processing Agreement, and the record of processing activities at docs/ops/processing-records.md.

7. Notes on this document

What is guaranteed. Accuracy about the software. Every statement about what a service receives was verified against the source code on 2026-08-23, and the file and line are cited so anyone can check the claim rather than trust it.

What was verified on 2026-08-23:the Resend email contents and the structural absence of phone number and email address from it; the Upstash rate-limit key on both consumer form doors and the absence of any Redis step in the erasure path; the Sentry scrubber's allow-list rebuild and its three string rules, and its silence on names and free text; every Inngest event type and its payload shape; the SMS assistant's Anthropic call and the import-graph test that bars the lead pipeline from any model provider; the source of every measurement question; and the database region, read live as us-west-2.

What was not verified, and is therefore not asserted:

• The contents of the production hosting environment. This session cannot read that dashboard. One consequence is worth naming: if the Upstash credentials are not set in production, no IP address reaches Upstash at all, because no rate limiter is ever constructed. That is a smaller disclosure and a larger security gap, and it is tracked separately. The same unreadability is why this page does not name Sentry's data region: the reporting endpoint is set there.
• Each vendor's legal entity name, taken from the vendor's own public terms rather than from a signed agreement held by Apex. Counsel should confirm each against the executed contract.
• Each vendor's current Data Privacy Framework certification status. See section 4.
• Retention periods applied by each sub-processor inside its own systems. Apex controls what it sends, not what a vendor keeps.
• The security posture of the lead-capture surface under adversarial testing. No penetration test has been run against it. Nothing on this page should be read as claiming one has.

One product limitation this document must not imply. Apex does not delete a client's customer data on a timer. That is the client's data and the client's decision. A configurable per-client retention cap is not available today: the field exists in the schema and the nightly sweep correctly skips every client that has no value set, but no screen and no script sets one. Any description of a settable retention cap would be wrong.

Keeping this true. Re-verify and re-date this page whenever a service is added or removed, whenever an existing service starts receiving a new category of personal data, or whenever a collection point changes.