A³ engages the third-party service providers listed below to deliver the Services. Each sub-processor is bound by a data processing agreement requiring data-protection commitments substantially equivalent to those A³ provides to Merchants.
We give Merchants at least 20 days' notice before adding or replacing a sub-processor. To receive change notifications, email privacy@triplea.studio with subject "subprocessor-notifications".
Current sub-processors
| Provider | Service | Purpose | Region | EU/UK transfer mechanism | DPA / Privacy |
|---|---|---|---|---|---|
| Google LLC | Google Cloud Platform (Cloud Run, Firestore, Cloud Storage, Firebase Auth) | Hosting, database, authentication | me-west1 (Israel); nam5 multi-region (US) for Firebase Storage | EU-US, UK-US, Swiss-US Data Privacy Framework (self-certified); SCCs Module 3 | link |
| Google LLC | Vertex AI / Gemini API | LLM inference for ambassador replies, topic clustering, KB extraction, SIE analyzer | US multi-region | EU-US / UK-US / Swiss-US DPF; SCCs Module 3; no training on customer data | link |
| Amazon Web Services, Inc. | EC2 (g6 GPU instances), S3, EBS, Bedrock (Claude) | MuseTalk avatar GPU compute (real-time lipsync), bundle storage, alternate LLM | us-east-1, us-east-2 | EU-US / UK-US / Swiss-US DPF (self-certified); SCCs Module 3; AWS DPA | link |
| Cerebrium Inc. | GPU serverless overflow | Burst capacity for MuseTalk workers when AWS warm pool saturated | US | SCCs Module 3 (executed); supplementary measures (encryption in transit + at rest) | link |
| Vercel Inc. | Frontend hosting + CDN | Hosting app.triplea.studio (Merchant dashboard, marketing landing) | Global edge; primary US | EU-US / UK-US / Swiss-US DPF (self-certified); SCCs Module 3 | link |
| Polar Software, Inc. (Polar.sh) | Subscription billing for direct-web subscribers | Payment processing, invoicing, customer portal for non-Shopify subscriptions | US (Stripe processor underneath) | SCCs Module 3 via Polar DPA; Stripe sub-sub-processor on EU-US DPF | link |
| Shopify Inc. | Shopify App Store distribution + Shopify Billing API + Admin GraphQL API | App distribution, recurring billing for Shopify-installed Merchants, store data access | Canada / US (adequate jurisdiction for Canada) | Canada adequacy decision; SCCs for US-region transfers via Shopify DPA | link |
Data Privacy Framework status: we monitor the self-certification status of each sub-processor on the public US Department of Commerce list at dataprivacyframework.gov/list. If a sub-processor's DPF certification lapses, we rely on the SCCs already executed with that sub-processor.
Future sub-processors (anticipated)
We anticipate engaging the following providers; the table will be updated with a 20-day notification before any becomes active.
- Twilio Inc. — voice and SMS surfaces (Enterprise tier, V2). Will be added if telephony / SMS feature ships.
- Sentry Inc. — error monitoring. Will be added if/when adopted; payloads scrubbed of PII before transmission.
- Help Scout / Intercom — customer support ticketing. Will process Merchant-provided identifiers only.
- Anthropic, PBC (via AWS Bedrock) — alternative LLM backend for redundancy. Same no-training-on-customer-data terms as primary Gemini path.
Sub-processor change history
Version 1.0 (May 19, 2026) — initial list.