Seros, LLC

Subprocessors

Effective date: [[EFFECTIVE_DATE]]

A subprocessor is a company we use to help run the Service that may process personal data on our behalf. This page lists them.

Every row below is a placeholder. No vendor has been confirmed. Do not publish this page until each [[TBD_VENDOR]] is replaced with the vendor actually in use, and every row that does not apply is deleted. Publishing a wrong subprocessor list is a data protection problem, not a typo.

This list is Annex III to the Data Processing Addendum.

Current subprocessors

# Subprocessor Purpose Personal data involved Location of processing Transfer mechanism Status
1 [[TBD_VENDOR]] Cloud hosting, compute, database and object storage All Customer Data and account data at rest and in transit [[TBD_LOCATION]] [[TBD_TRANSFER_MECHANISM]] Not confirmed
2 [[TBD_VENDOR]] Transactional and notification email delivery Recipient name, email address, message content [[TBD_LOCATION]] [[TBD_TRANSFER_MECHANISM]] Not confirmed
3 [[TBD_VENDOR]] Payment processing and subscription billing Billing contact, billing address, tax identifiers, payment tokens, invoice history [[TBD_LOCATION]] [[TBD_TRANSFER_MECHANISM]] Not confirmed
4 [[TBD_VENDOR]] Product analytics and usage measurement User and workspace identifiers, event and page data, IP address, device and browser data [[TBD_LOCATION]] [[TBD_TRANSFER_MECHANISM]] Not confirmed
5 [[TBD_VENDOR]] Error and crash tracking, performance monitoring User identifier, IP address, stack traces and any personal data incidentally captured in an error payload [[TBD_LOCATION]] [[TBD_TRANSFER_MECHANISM]] Not confirmed
6 [[TBD_VENDOR]] AI model provider — task drafting, routing, summarisation Prompts and the Customer Data sent with them, plus generated output [[TBD_LOCATION]] [[TBD_TRANSFER_MECHANISM]] Not confirmed
7 [[TBD_VENDOR]] AI model provider — secondary or fallback model Prompts and the Customer Data sent with them, plus generated output [[TBD_LOCATION]] [[TBD_TRANSFER_MECHANISM]] Not confirmed
8 [[TBD_VENDOR]] Customer support helpdesk and ticketing Name, email, support message content, attachments [[TBD_LOCATION]] [[TBD_TRANSFER_MECHANISM]] Not confirmed
9 [[TBD_VENDOR]] Customer relationship management and sales email Business contact details, correspondence, deal records [[TBD_LOCATION]] [[TBD_TRANSFER_MECHANISM]] Not confirmed
10 [[TBD_VENDOR]] Logging, metrics and observability Log records including IP address and user identifiers [[TBD_LOCATION]] [[TBD_TRANSFER_MECHANISM]] Not confirmed
11 [[TBD_VENDOR]] Authentication, single sign-on and identity Email address, authentication events, identity provider identifiers [[TBD_LOCATION]] [[TBD_TRANSFER_MECHANISM]] Not confirmed

Affiliates

Seros, LLC has no affiliates at present. If affiliates are formed and they process Customer Data, list them here.

Notes for filling this in

For each vendor, record and keep on file:

  1. The vendor's full legal name, not its product name.
  2. Its role: processor or independent controller. Some analytics and payment vendors insist on being controllers, which changes what you can promise customers.
  3. Whether a data processing agreement is signed, and where the signed copy lives.
  4. The transfer mechanism for data leaving the EEA or UK: SCCs with the UK Addendum, or a valid EU-US Data Privacy Framework certification verified on the official DPF list. Do not write "DPF" unless you have checked the vendor's live certification status and the scope covers the data you send.
  5. The region the data actually sits in, not the vendor's headquarters.
  6. For AI model providers specifically: whether training on submitted data is off by default, the retention period for prompts and outputs, whether zero-retention or no-training terms require a specific plan or a signed addendum, and whether the provider uses its own subprocessors in other countries.
  7. The date of the last review. Review the whole list at least annually.

How customers are told about changes

Before adding a new subprocessor that will process Customer Personal Data, we give at least 30 days' notice to everyone subscribed to this list.

To subscribe: email privacy@seros.dev with the subject "Subprocessor notifications" and the address that should receive them. We keep the list separate from marketing email; there is nothing else in it. To unsubscribe, reply and say so.

A customer may object to a new subprocessor on reasonable data protection grounds within 15 days of the notice. The objection process and its outcome are in Section 6 of the DPA.

Where a change is required urgently for security or continuity, we may make it first and notify promptly afterwards. The objection window then runs from the date of that notice.

Change log

Date Change Notice given
[[EFFECTIVE_DATE]] Initial draft list. No vendors confirmed. Not applicable — not yet published

What I need from you

  1. The actual vendor for every row, or deletion of the row.
  2. Signed DPAs from each one, filed somewhere you can find them.
  3. A decision on the notice and objection windows so they match the DPA.
  4. A calendar reminder to review this list annually.