Sub-processors · Orkestriq

Orkestriq (Automyx Ltd) engages the third-party sub-processors below to help deliver the Services. Each is bound by written data-protection terms requiring confidentiality, security, and processing only on documented instructions. This list is referenced by our Privacy Policy and Data Processing Agreement.

Current sub-processors

Provider	Purpose	Data processed	Location	Transfer safeguard
Supabase (Supabase, Inc.)	Database, authentication and file storage	All platform data (account, attendee, event records)	European Union (EU)	UK Addendum to the EU SCCs for UK → EU transfers
Vercel (Vercel, Inc.)	Application hosting and content delivery	Request data, IP addresses, logs	United States (global edge)	SCCs / UK Addendum
OpenAI (OpenAI, L.L.C.)	AI event assistant (response generation)	Attendee questions and event knowledge base/programme sent to the assistant	United States	SCCs / UK Addendum; API data not used for training
Resend (Resend, Inc.)	Transactional and event email delivery	Recipient name, email address, email content	United States	SCCs / UK Addendum
Google (Google LLC)	Web font delivery (where not self-hosted)	Visitor IP address (at the time fonts load)	United States	SCCs / UK Addendum
Stripe (Stripe Payments Europe, Ltd.)	Subscription billing and payment processing	Billing contact name and email, billing address, VAT/tax ID, payment card details (handled directly by Stripe), subscription and invoice records	Republic of Ireland (EU), with support processing in the United States	SCCs / UK Addendum; Stripe is PCI DSS Level 1 certified

Our primary datastore (Supabase) is hosted in the EU, so attendee and event records are stored within the EEA. Some processing for email, hosting edge delivery and the AI assistant involves transfers to the United States, protected by the safeguards listed above.

To verify before launch Confirm each provider's DPA/SCCs are executed and on file. If web fonts are self-hosted, the Google entry can be removed. Update this table whenever a provider is added or changed (organisers receive at least 10 days' notice of material changes).

Changes & objections

We will give event organisers at least 10 days' notice of any intended addition or replacement of a sub-processor. If you reasonably object on data-protection grounds within that period, you may terminate the affected Services with a pro-rata refund, as set out in our Data Processing Agreement.