Subprocessor List
Effective date: 2026-09-25
Last updated: 2026-09-25
Version: 2026-09-25
About this page
This page lists the sub-processors AIMLGov, s.r.o. ("AIMLGov", "we", "us") currently engages to provide the AIGov platform ("Service") to its Customers, and explains how we keep this list up to date.
This page is incorporated by reference into the Data Processing Agreement ("DPA") available at https://govbase.dev/dpa. The contractual mechanism governing sub-processors — including the Customer's general authorization, notice of changes, and objection rights — is set out in Section 6 of the DPA. If anything on this page conflicts with the DPA regarding the contractual mechanism (rather than the current facts about who our sub-processors are), the DPA prevails.
List of subprocessors
| Sub-processor | Service provided | Role | Processing location | Transfer mechanism |
|---|---|---|---|---|
| Vercel Inc. | Application hosting (frontend, serverless functions), Web Analytics, Speed Insights | Processor / sub-processor | Functions: iad1 (USA) | Vercel Data Processing Agreement, including EU Standard Contractual Clauses |
| Railway Corp. | Backend hosting and PostgreSQL database hosting | Processor / sub-processor | us-west2 (USA) | Railway Data Processing Agreement — EU Standard Contractual Clauses; UK Addendum for UK transfers |
| Cloudflare, Inc. | DNS, reverse proxy, Email Routing | Processor / sub-processor | Global anycast network | Cloudflare Data Processing Agreement, covering transfers from the EEA, Switzerland, and the UK |
| Stripe, Inc. / Stripe Payments Europe, Ltd. | Payment processing and subscription billing | Processor / sub-processor; independent controller for Stripe's own regulatory purposes | Global, per Stripe's own infrastructure | Stripe Data Processing Agreement and Data Transfers Addendum — EU–U.S. Data Privacy Framework and Standard Contractual Clauses |
| Resend, Inc. | Transactional email delivery | Processor / sub-processor | Primary sending region: eu-west-1 | Resend Data Processing Agreement — EU Standard Contractual Clauses; UK Addendum for UK transfers |
Note on Stripe's role: Stripe's legal role varies by the specific service and data flow involved. For processing personal data strictly to execute a payment or manage a subscription on the Customer's/AIMLGov's instructions, Stripe acts as a processor/sub-processor. For processing Stripe carries out for its own regulatory compliance purposes (e.g., anti-money-laundering, fraud prevention, and "Know Your Customer" obligations applicable to Stripe as a payment institution), Stripe acts as an independent controller. This dual role is disclosed to Customers and end users as appropriate and does not change AIMLGov's own controller/processor allocation.
Note on Resend: the fact that the primary sending domain is configured in eu-west-1 does not mean all related processing by Resend and its own sub-processors is confined to the EEA; Resend's published sub-processor list should be reviewed periodically and referenced from the AIGov Subprocessor List page.
Several sub-processors above process data in, or may route data through, the United States or other locations outside the European Economic Area ("EEA"). Where this occurs, we rely on appropriate safeguards — in particular the European Commission's Standard Contractual Clauses and, where relevant, the UK International Data Transfer Addendum — as implemented through each sub-processor's own data processing agreement, summarized in the table above. Further detail on the general transfer mechanism is set out in Annex 2 of the DPA.
Email notifications for changes to this list
You can opt in to receive an email when this list changes, in addition to publication on this page (which is valid notice under the DPA regardless of that subscription). Enable this under Settings → Notifications → "Notify me about subprocessor changes" while signed in.
Contact
Questions about this page or a specific sub-processor: legal@govbase.dev.
Tenant-scoped acceptance is recorded only at /legal/acceptance after authentication — not on this page.