1. Product subprocessors
None engaged. AAES is client-operated software: it runs in the client's own environment (a single VM with Docker Compose, Kubernetes with Helm or Terraform, or an air-gapped deployment), and AAES receives no product traffic and holds no client product data. The default client-hosted build links no third-party module (the pinned Postgres driver is compiled only behind the optional postgres build tag), makes no telemetry call and no licence check, and its only outbound calls are to endpoints the client registers.
Optional support may involve a client-authorized, one-off transfer of diagnostic material (logs, screenshots, attachments), agreed in writing before anything is sent, as described in the privacy policy. The "none engaged" statement above holds only where no support material is received: if diagnostic material contains personal data and arrives through a provider listed in section 2 (for example the mailbox host), that provider processes it on our behalf for that engagement under its own processor terms.
2. Website and correspondence providers
These providers support the aaes.ai website and business correspondence only. They are not product subprocessors and they do not receive client product data.
| Provider | Role | Location of processing | Transfer safeguards |
|---|---|---|---|
| Render | Website hosting and the contact-form endpoint | Singapore (site hosting); Render is a US-based company | EU-U.S. Data Privacy Framework (incl. UK Extension and Swiss-U.S. DPF); Render's DPA incorporates the EU SCCs and UK Addendum. Render DPA |
| Google (Analytics 4) | Aggregate, cookieless website measurement; analytics storage and advertising features disabled | United States | EU-U.S. Data Privacy Framework, incl. UK Extension and Swiss-U.S. DPF |
| Resend | Contact-form email delivery, when configured | United States (primary processing and storage) | EU-U.S. Data Privacy Framework and UK Extension; pre-signed DPA with EU SCCs (Module Two, or Module Three where we act as processor), UK Addendum and Swiss modifications. Resend GDPR overview |
| PrivateEmail (Namecheap) | Mailbox hosting for hello@aaes.ai | Set by Namecheap's mailbox infrastructure | Processed under Namecheap's Universal Terms of Service and Privacy Policy; we have not verified a separate transfer mechanism and state none. PrivateEmail privacy policy |
A provider's certification does not by itself establish coverage for every transfer. The transfer arrangements for correspondence are described in full in the privacy policy, section 6.
3. Changes to this list
We will update this page before engaging a new provider that processes personal data for the website or correspondence, and before any hosted service accepts client data. The "Last updated" date above records the current revision.
A subscriber notification mechanism does not exist yet: there is no client-facing service processing data to notify about. Where a processing agreement is in place for a support engagement, its own notice terms govern that engagement.