Legal
Sub-processors
Effective date: September 1, 2026 · Last updated: September 1, 2026
Thought Media™, operating Asyrx, uses third-party service providers to help deliver, secure, maintain, and support the Services. When a provider processes Customer Personal Data on behalf of Asyrx in connection with the Services, that provider is a “Sub-processor.”
This page is the authoritative public list referenced by the Asyrx Data Processing Addendum.
Current production sub-processors
| Provider | Purpose | Data processed | Processing location |
|---|---|---|---|
| Supabase, Inc. | PostgreSQL database, authentication, storage and backend application services as configured | Organization and user account data, roles, authentication records, agent registrations, proposed-action metadata, assessment records, policy and configuration data, API-key records, audit and API request logs, and enterprise access-request submissions | United States (AWS us-east-2) |
| Cloudflare, Inc. | DNS, CDN, network and API traffic delivery, TLS termination, edge and network security including DDoS protection | IP addresses, HTTP request metadata, and network/security telemetry for traffic routed through Cloudflare infrastructure; request and response content passes through in transit rather than being retained as a customer record | Cloudflare globally distributed edge infrastructure |
| Lovable (Lovable Labs Incorporated) | Application hosting and operation of the Asyrx application, managed provisioning of the Asyrx backend project, and transactional email delivery for service notifications | Application traffic and runtime data processed in the hosted environment, plus the name, email address and message content contained in emails Asyrx sends from notify.asyrx.com | Provider cloud infrastructure |
Asyrx does not send assessment data, action metadata or customer content to any third-party AI or large-language-model provider. The Asyrx risk engine is deterministic and runs within the Asyrx application. Asyrx does not use a separate marketing-analytics, advertising or third-party error-monitoring provider.
Service providers that are not sub-processors
Some vendors used for software development, source-code management, corporate operations, or professional services do not receive Customer Personal Data from the production Services and are therefore not Sub-processors. Asyrx classifies vendors based on actual data flows rather than listing every internal tool.
Certain infrastructure providers supporting Asyrx maintain their own security and compliance programs, including certifications such as SOC 2 Type II and ISO 27001. Those certifications apply to the respective provider and do not constitute certifications of Asyrx or Thought Media™.
Changes to the list
Asyrx may add or replace Sub-processors as the Services evolve. Where required by the applicable DPA, Asyrx will provide advance notice of material new Sub-processors and permit Customer to raise reasonable data-protection objections within the period stated in the DPA.
Data locations
Processing location may depend on the customer’s selected environment, infrastructure region, vendor architecture, support location, and optional services. Enterprise customers with data-residency requirements should raise them before production deployment.
Questions or objections
Enterprise customers may contact info@asyrx.com with Sub-processor questions or an objection submitted under an applicable DPA. The request should identify the customer organization, relevant Sub-processor, and specific data-protection concern.
Contact
- Operator
- Thought Media™, operating Asyrx
- Contact
- info@asyrx.com
- Website
- https://asyrx.com