Legal

Sub-processors

Last updated: September 18, 2026

These are the providers that process personal data on our behalf to run AtlasVector, listed by role: what each one does for the Service, the categories of personal data it can see, and where it processes them. Each provider's legal name, and the transfer mechanism executed with it (section 5 of the Privacy Policy), are stated in our data-processing agreement, available from [email protected].

Where our deployment configuration fixes a processing location, the row states it; where the location is a setting chosen at deploy time, the row says so rather than guessing. The market-data sources behind the prices and fundamentals you see are not sub-processors: they send data to us and receive no personal information about you.

Register

Cloud hosting and infrastructure

What it does: Runs the API, the background worker, the ML service and the workflow server, and holds the databases and the cache — everything the Service stores.
Personal data it can see: Every category in section 1 of the Privacy Policy: account information, usage and diagnostic logs, the content you enter, and waitlist and contact submissions.
Where it processes: One cloud region, as configured by the operator at deploy time — the region is a deployment setting, not fixed in our source.

Edge network and public-site delivery

What it does: Serves the public site and the app shell from its edge, terminates your connection, filters abusive traffic, and verifies the bot check on sign-in.
Personal data it can see: Your connection's IP address and browser signature, the pages you request, and — on sign-in — the bot-check token together with the connecting IP address.
Where it processes: At the provider's global edge network, nearest to your connection; the location is not fixed by our configuration.

Web-font delivery

What it does: Serves the public site's typefaces; your browser fetches them directly when a page first paints.
Personal data it can see: Your connection's IP address and browser signature for the font request — nothing else: no account, no page content, no identifier of yours.
Where it processes: At the provider's own network; the location is not fixed by our configuration.

Identity and sign-in

What it does: Proves the first sign-in factor — your email and password, or a social sign-in — and runs the one-time phone verification, including that step's own bot check. Two-factor security (the authenticator) is ours and involves no provider. Where the operator has not enabled this provider, sign-in runs on our own servers and this row does not apply.
Personal data it can see: Your email address, the sign-in credential or social identity you present, your phone number for one-time verification, and your connection's IP address for those steps.
Where it processes: On the provider's infrastructure; the location is not fixed by our configuration.

Transactional email delivery

What it does: Delivers verification codes, the emailed step-up code, and account and security notices. We send no marketing email through it without your consent.
Personal data it can see: Your email address and the content of each message — a code, a notice.
Where it processes: On the provider's infrastructure; the location is not fixed by our configuration.

Payment processing

What it does: Hosts the checkout page and bills the subscription. Card numbers never touch our servers. Where the operator has not configured card checkout, the pricing page says so and this row does not apply.
Personal data it can see: Your email address and an internal account reference from us; the card details you enter on its page, directly from you; it returns your subscription status and a customer reference.
Where it processes: On the provider's infrastructure; the location is not fixed by our configuration.

Reasoning engines (two providers)

What it does: Generates the answers to questions you submit to AI features, and reads the documents you ask to have parsed.
Personal data it can see: The text of your question and the content the request carries — a ticker, a note, a document you upload. It is not used to build advertising profiles.
Where it processes: On each engine's own infrastructure. Either engine may answer either kind of request; for the engine whose location we configure, it is as set by the operator, defaulting to the provider's global endpoint; for the other, the location is not fixed by our configuration.

Error and performance monitoring

What it does: Keeps request logs and error traces, runs uptime checks, and raises alerts. There is no separate monitoring provider: this runs on the hosting provider's own logging and alerting.
Personal data it can see: Request logs and error traces — the same data the hosting row can see, and nothing the hosting provider does not already hold.
Where it processes: The same region as hosting, as configured by the operator.

Changes

We give at least 30 days' notice before a new sub-processor begins processing personal data, so you have time to object. Email [email protected] to be added to the change list. Changes are reflected on this page with an updated date.

Contact

Questions about this register, or a copy of the data-processing agreement: [email protected].