Sub-processors
The vendors X3 Lab uses to operate X3-RONIN. Each sub-processor is bound by data-protection obligations no less protective than our own. This page is referenced from our Privacy Policy and Data Processing Agreement.
| Sub-processor | Purpose | Processing location | Terms |
|---|---|---|---|
| Supabase Inc. | Managed Postgres, authentication, object storage for tenant data. | Singapore (ap-southeast-1) | privacy · DPA |
| Amazon Web Services | Underlying compute, storage, and network for Supabase and any X3 Lab-managed compute. | Singapore | privacy · DPA |
| Stripe, Inc. | Payment processing, subscription billing, invoice generation. | United States, EU | privacy · DPA |
| Postmark / [TBD] | Transactional email delivery: OTP login codes, billing receipts, security notices. | United States | privacy · DPA |
| Functional Software, Inc. (Sentry) | Error and performance monitoring for the platform. | United States, EU | privacy · DPA |
| Discord, Inc. | Tenant-controlled webhook alert delivery. Strictly opt-in per tenant; webhook URL stored encrypted. | United States | privacy |
| Cloudflare, Inc. | DNS, edge security, DDoS protection for public surfaces. | Global edge | privacy · DPA |
How we manage sub-processors
Each sub-processor is engaged under written data-protection terms aligned with our DPA. We require encryption in transit, encryption at rest, breach-notification commitments, and the international- transfer mechanisms described in our Privacy Policy and DPA (including EU Standard Contractual Clauses and the UK Addendum where applicable).
Notice of change
We notify enterprise customers by email and update this page at least 30 days before adding or replacing a sub-processor. Enterprise customers may object on reasonable data-protection grounds; the process is described in our DPA.
What is not on this list
- Execution venues you connect (for example MEXC, Binance, Hyperliquid). These remain your counterparties; we are not their sub-processor.
- Public data providers we query as data sources (for example FRED, DefiLlama). These are upstream feeds, not sub-processors. See our data licensing page for the upstream feed list.
- Inference providers (for example OpenAI, Google Gemini) — listed separately when customer data is routed to them; opt-in tier surfaces document the routing explicitly.