Subprocessors
Effective date: September 22, 2026
A subprocessor is a company we use that may process personal data on our behalf. This page lists them.
Seros is a solution development company and does not currently operate a hosted service. Where we build a system for you, it is normally deployed to infrastructure you own and control, and the vendors underneath it are yours, not ours, and are recorded in the Statement of Work rather than here. This page covers vendors that process personal data on our behalf — for our own business and for anything we host or operate for a client.
This list is Annex III to the Data Processing Addendum.
Current subprocessors
Seros currently operates a marketing website and no hosted customer-facing application, so no vendor processes client personal data on our behalf today. The website is statically hosted and has no analytics, no forms and no cookies beyond what the host sets to serve the files; enquiries arrive by ordinary email.
Add a row to the table below — and sign a DPA — before any vendor touches client personal data, including when we take on hosting or a care plan for a client system. Do not list a model that runs inside our own boundary as a third-party subprocessor; if a hosted AI provider is used on client data, it must be listed here first.
Paused: the in-house product stack
The vendors below were integrated by the in-house Slack-to-tracker application. That application is paused and is not deployed, so none of these vendors is processing client personal data at present. The rows are kept because the deployment can be resumed, and because the same diligence will be required if it is. Each must be re-verified, and a DPA signed, before any of them processes client data.
| # | Subprocessor | Purpose | Personal data involved | Location of processing | Transfer mechanism | Status |
|---|---|---|---|---|---|---|
| 1 | Vercel * | Application hosting: serverless compute, edge network, TLS termination and request routing for app.seros.dev, and the platform through which the production Postgres database is provisioned. Also processes application, access and request logs. |
All Customer Personal Data and account data in transit and transiently in compute; request and access logs including IP address, user identifiers, and device and browser data | not applicable — no subprocessor is currently engaged | not applicable — no subprocessor is currently engaged | Paused — application not deployed; vendor DPA not signed or filed |
| 2 | Neon * (production Postgres, provisioned through Vercel) | Durable primary database: stores all application data at rest, including source content ingested from connected integrations, accounts, tasks and audit logs, plus automated backups | All Customer Personal Data and account data at rest — identification and contact data, communications content ingested from connected sources, task and workflow data, and authentication and technical/log data | not applicable — no subprocessor is currently engaged | not applicable — no subprocessor is currently engaged | Paused — application not deployed; vendor DPA not signed or filed |
| 3 | Slack * | Source integration: the Service reads messages and events from the Slack workspaces the customer authorises, to detect commitments and draft tasks | Message content, author name/handle and role, channel and workspace identifiers, timestamps, and any personal data contained in the messages ingested | not applicable — no subprocessor is currently engaged | not applicable — no subprocessor is currently engaged | Paused — application not deployed; vendor DPA not signed or filed |
| 4 | Linear * | Task-tracker integration: the Service creates and updates issues/tasks in the customer's Linear workspace | Task title and description (which may contain personal data drawn from source content), assignee identity, and team and workspace identifiers | not applicable — no subprocessor is currently engaged | not applicable — no subprocessor is currently engaged | Paused — application not deployed; vendor DPA not signed or filed |
| 5 | Google — Gemini API, accessed via the OpenAI-compatible endpoint * | AI model provider: task detection and drafting, assignee suggestions and summarisation | The parts of Customer Content a feature needs — the text of the message or document being turned into a task, related task records, and the names and roles of the people involved so it can suggest an assignee — plus the generated output | not applicable — no subprocessor is currently engaged | not applicable — no subprocessor is currently engaged | Paused — application not deployed; provider data-retention/no-training terms and DPA not confirmed (see How Seros uses AI) |
* Product/company names are shown for identification. The full legal entity name, registered address, the vendor's own subprocessors, the location where data is actually processed, the cross-border transfer mechanism, and the signed DPA will be recorded for each row before that vendor processes client personal data.
Not yet applicable — no subprocessor in use. We have no email-delivery, payment/billing, product-analytics, error-tracking, customer-support, CRM, third-party observability or external identity vendor that processes client personal data. Invoicing is manual and client correspondence is ordinary business email. The placeholder rows for those categories have been removed rather than left blank. Add a row here — and sign a DPA — before any such vendor touches client personal data.
Affiliates
Seros, LLC has no affiliates at present. If affiliates are formed and they process Customer Data, list them here.
How customers are told about changes
Before adding a new subprocessor that will process Customer Personal Data, we give at least 30 days' notice to everyone subscribed to this list.
To subscribe: email team@seros.dev with the subject "Subprocessor notifications" and the address that should receive them. We keep the list separate from marketing email; there is nothing else in it. To unsubscribe, reply and say so.
A customer may object to a new subprocessor on reasonable data protection grounds within 15 days of the notice. The objection process and its outcome are in Section 6 of the DPA.
Where a change is required urgently for security or continuity, we may make it first and notify promptly afterwards. The objection window then runs from the date of that notice.
Change log
| Date | Change | Notice given |
|---|---|---|
| September 22, 2026 | First published list. No active subprocessor; the paused in-house product stack (Vercel, Neon, Slack, Linear, Google/Gemini) is listed for transparency. | Not applicable — first publication |