Subprocessor Registry

AMSync.ai Subprocessor Registry

Last Updated: September 19, 2026
Version: 1.0

AMSync.ai uses third-party service providers (“Subprocessors”) to help deliver, secure, support, and operate the AMSync platform.

This registry identifies material Subprocessors that may process Customer Personal Data on behalf of AMSync.

The inclusion of a provider does not necessarily mean that every AMSync customer uses every service or integration listed below.

Current Subprocessors

---

Provider Details

Vercel

Provider: Vercel, Inc.

Function:
Cloud hosting and application infrastructure.

AMSync uses Vercel to deploy and operate the AMSync web application and related server-side application functionality.

Depending upon the AMSync architecture and request, information processed through Vercel may include:

• application requests;
• IP addresses and network information;
• browser/device information;
• server and application logs;
• authentication/session-related requests;
• API requests; and
• Customer Data transmitted through application functions.

Vercel maintains its own list of subprocessors and processing locations.

AMSync should periodically review Vercel's current Data Processing Addendum and Subprocessor disclosures.

---

Supabase

Provider: Supabase, Inc.

Function:

• PostgreSQL database;
• authentication;
• backend services;
• file/object storage; and
• related application infrastructure.

Supabase is one of AMSync's principal Customer Data infrastructure providers.

Information maintained through Supabase may include:

• customer records;
• customer contact information;
• insurance policy information;
• insurance applications;
• vehicle information;
• transaction records;
• account balances;
• service-fee information;
• user profiles;
• permissions and access assignments;
• authentication information;
• documents;
• identification images;
• vehicle photographs;
• secure mobile uploads;
• notes;
• tasks;
• audit records;
• workforce information; and
• other Customer Data entered into AMSync.

Data Location

Supabase projects are deployed to a designated primary region.

AMSync should identify the actual production Supabase project region in its internal vendor inventory.

If the production project is moved to another region, this registry should be reviewed and updated where appropriate.

---

Stripe

Provider: Stripe, Inc. and/or the applicable Stripe contracting affiliate.

Function:

• AMSync subscription payments;
• billing;
• payment-method processing;
• subscription management;
• invoice processing; and
• related financial services.

Information may include:

• organization name;
• billing contact;
• billing email;
• Stripe customer identifier;
• subscription information;
• invoice information;
• payment status;
• transaction information;
• payment-method information; and
• fraud/security information required by Stripe.

Payment Card Information

AMSync should use Stripe-hosted or Stripe-supported payment mechanisms wherever practical so that complete payment-card credentials do not need to be stored directly in AMSync.

The Subprocessor Registry should not state that AMSync stores complete payment-card numbers or CVV data unless the production architecture actually does so.

---

Resend

Provider: Plus Five Five, Inc., operating Resend.

Function: Transactional email infrastructure.

AMSync may use Resend to send:

• user invitations;
• account notifications;
• authentication-related communications where applicable;
• password/account notices;
• system alerts;
• transaction notifications;
• customer communications;
• administrative messages; and
• other transactional email.

Information processed may include:

• email address;
• sender and recipient information;
• subject;
• message content;
• email metadata;
• delivery records;
• webhook payloads;
• bounce information; and
• engagement information where applicable.

Data Location

Resend states that customer data, including message content, delivery logs, webhook payloads and account records, is stored in the United States.

---

Sent

Provider: Sent, Inc.

Function: Customer messaging and communications.

AMSync uses Sent for SMS, WhatsApp, RCS, and related customer messaging and communications.

Depending upon the integration, information may include:

• telephone numbers;
• customer name;
• message content;
• sender information;
• delivery status;
• timestamps;
• message identifiers;
• opt-in/opt-out status;
• communication history; and
• technical delivery information.

Vendor Review

AMSync should periodically review Sent's applicable account terms, Privacy Policy, DPA, security materials, and subprocessor disclosures, including:

1. exact legal entity;
2. service URL;
3. categories of Customer Data received;
4. processing/storage countries;
5. downstream subprocessors;
6. data-retention practices;
7. security commitments;
8. whether message content is retained;
9. applicable DPA; and
10. breach-notification terms.

Processing Location: United States and other jurisdictions where Sent's authorized subprocessors operate, subject to Sent's applicable data-processing terms.

---

Google Maps Platform

Provider: Google LLC and applicable Google affiliates.

Function:

• address autocomplete;
• address search;
• address validation;
• mapping;
• geocoding; and
• location-related functionality.

AMSync may transmit information such as:

• street addresses;
• city/state/ZIP information;
• address search queries;
• approximate location-related information;
• IP/network information; and
• API request metadata.

Google Maps Platform also logs technical information associated with API requests.

AMSync should avoid transmitting unnecessary insurance, policy, financial, or sensitive customer information to Google Maps APIs when an address or location query alone is sufficient.

---

Subprocessor Data-Minimization Requirement

AMSync will seek to provide each Subprocessor only the information reasonably necessary to provide the applicable service.

For example:

Google Maps Platform

Send:

123 Main Street, Houston, TX 77002

Do not unnecessarily send:

John Doe – Progressive Policy 12345678 – $625 balance – SR-22

The same data-minimization principle should apply across all AMSync integrations.

---

Artificial Intelligence Providers

AMSync does not automatically designate an artificial-intelligence provider as an approved Customer Data Subprocessor simply because AMSync developers or personnel use an AI tool.

Before Customer Data may be transmitted to an external AI provider in a production AMSync feature, AMSync should conduct a vendor/privacy review addressing:

• information transmitted;
• processing purpose;
• retention;
• model-training practices;
• zero-retention availability;
• security;
• geographic processing;
• subprocessors;
• confidentiality obligations;
• deletion;
• incident notification; and
• applicable contractual protections.

Once an external AI provider processes Customer Personal Data as part of a production AMSync service, the provider should be evaluated for inclusion in this Registry.

---

Changes to Subprocessors

AMSync may add, replace, or discontinue Subprocessors as the Service evolves.

AMSync will maintain a current record of material providers that process Customer Personal Data.

Where required by contract or applicable law, AMSync will provide appropriate notice before a material new Subprocessor begins processing Customer Personal Data.

---

Subprocessor Review

AMSync should review its Subprocessor Registry:

• at least annually;
• when a new material provider is added;
• when a provider begins processing a new category of Customer Data;
• when a provider materially changes its processing location;
• when AMSync introduces a new integration;
• when AMSync introduces external AI processing; or
• following a material vendor security or privacy incident.

The internal vendor inventory should additionally record:

• provider;
• legal entity;
• service owner within AMSync;
• business purpose;
• Customer Data categories;
• sensitivity classification;
• processing locations;
• contract date;
• DPA status;
• security review date;
• SOC 2/ISO status where applicable;
• breach-notification requirement;
• retention practices;
• subprocessors;
• renewal date; and
• termination/data-deletion procedure.

---

Questions

Questions concerning AMSync's Subprocessors may be directed to:

Privacy: Legal@amsync.ai
Security: Support@amsync.ai

AMSync.ai
AMSync.ai
AMSync.ai LLC
811 Park Two Dr., Sugar Land, TX 77479
Legal@amsync.ai
Support@amsync.ai