Subprocessors

How to read this list

Topolo Technology Inc. uses managed providers for the services described below. A feature-specific provider receives the information needed for that feature when used; an organisation's supported routing and settings determine the applicable provider. Topolo's own products, including Auth, Nexus, Consent and Pay, are not separate legal companies merely because they have different product names.

The DPA governs Topolo-engaged processing, international safeguards, provider changes and objections. Processing may include the United States and service-specific international operations. Retention and onward processing are limited by the relevant service, instructions, contractual obligations and applicable law.

Core infrastructure

Cloudflare, Inc. supplies edge delivery, hosting/runtime, security and application data services, including Workers, D1, KV, R2, Turnstile, analytics where enabled, and Cloudflare-backed AI or email where used. Data may include hosted customer records/content, identifiers, requests, security/operational metadata and instructed AI/email inputs. Processing uses the United States and Cloudflare's global network and service locations, subject to any explicitly applicable supported product configuration. See Cloudflare's privacy information and data processing terms.

Email providers

Amazon Web Services, Inc. provides Amazon SES where used for transactional or other instructed email delivery. Relevant data includes sender/recipient addresses, message content, attachments where used, and delivery/security metadata. Processing includes the United States and the configured SES service region. See AWS data protection information.

Plus Five Five, Inc. (Resend) is an alternative supported email provider where enabled. It processes the email content, addresses and delivery metadata needed for the selected feature, using US and applicable service/subprocessor operations. See Resend's DPA. Cloudflare email, where used, is covered by the Cloudflare entry above.

Managed AI providers

The following providers may process instructed prompts, relevant context/content, outputs and technical metadata when their supported managed features are used. Processing includes the United States and locations used for the selected API service. Do not submit data subject to incompatible regional, sensitive-data or provider-use restrictions.

• OpenAI OpCo, LLC for supported OpenAI API features. Services agreement and processing terms.
• Anthropic, PBC for supported Anthropic API features. Commercial terms.
• Google LLC for supported Google/Gemini API features. API terms.
• xAI/Grok, provided under the applicable API agreement by SpaceX Super Intelligence LLC or the provider entity identified in Topolo's applicable existing API agreement, for supported Grok API features. Current enterprise terms and version history.

Cloudflare-hosted model processing is covered by Cloudflare above; a model's name alone does not mean a separate direct disclosure to its original model developer. A customer-owned provider account or assistant connection can instead be an independent service selected by that customer. Applicable provider restrictions, routing and service agreements must be satisfied before use.

Payments and customer-selected connections

Payment features may use Stripe and the payment entity identified in the relevant checkout or payment agreement. Payment providers can have independent controller duties for payment, fraud prevention and legal compliance; they are not automatically processors for every activity. They process payment/contact/transaction information needed for the payment, not all hosted survey or CRM content. See Stripe's privacy information.

A customer-selected AI assistant, mailbox, WhatsApp/Meta account, integration destination or other recipient processes information under the customer's instructions and applicable provider relationship. Authorising a connection or recipient is separate from authorising Topolo's infrastructure subprocessors. The customer must assess its disclosures, permissions and legal arrangements; Topolo remains responsible where it itself engages a provider as subprocessor.

Changes and questions

The DPA provides the change-notification and objection procedure for applicable Topolo-engaged subprocessors. Contact privacy@topolo.io with your organisation and feature for relevant provider/transfer information.