Sub-processors
Last updated: 2026-04-30
Kironyx engages the third-party sub-processors below to provide our service. This list is published in fulfillment of GDPR Art. 28(2) transparency requirements and equivalent obligations under other privacy regimes.
Current sub-processors
| Sub-processor | Purpose | Region | Compliance |
|---|---|---|---|
| Amazon Web Services (AWS) | Application hosting (Lambda, DynamoDB, S3, Cognito, API Gateway, Step Functions, SES, Secrets Manager, CloudWatch) | us-east-1 (N. Virginia) | SOC 2 Type II, ISO 27001, ISO 27017, ISO 27018 |
| AWS Amplify | Frontend hosting and CI/CD | us-east-1 | Inherits AWS compliance posture |
| Anthropic | AI model API (Claude Sonnet 4.5, Haiku 4.5, web_search tool) | US infrastructure | SOC 2 Type II |
| Paddle | Payment processing and merchant of record (subscriptions, tax, billing) | UK / EU global | PCI DSS Level 1, SOC 2 Type II |
| GitHub | Source code hosting; CI integration with Amplify | US | SOC 1/2/3 Type II, ISO 27001 |
What data each sub-processor sees
- AWS sees all customer data (it hosts our database and storage). All data is encrypted at rest and in transit. AWS does not access customer data except as required to operate the infrastructure.
- Anthropic sees the prompts we send (containing competitor names, URLs, and our internal research/analysis context). Anthropic does not use this data for model training. We never send Anthropic our customers' account credentials, billing data, or email contents.
- Paddle sees billing-related data (your name, email, billing address, payment method, transaction history). They do not see your competitor list or research content.
- GitHub sees our application source code. They do not see customer data, only commits to our internal repository.
Notification of changes
Per GDPR Art. 28(2), customers will be notified by email of any new sub-processors at least 30 days before that sub-processor begins processing personal data, with an opportunity to object. To subscribe to change notifications, email privacy@kironyx.com with subject "sub-processor updates".
Questions
For sub-processor due-diligence requests, copies of executed Standard Contractual Clauses, or specific compliance documentation beyond what's listed above, contact legal@kironyx.com.