The third parties involved in processing your data.

Two categories of third party touch your data. The first is the cloud substrate where the platform runs (Cloudflare on default deployments, or AWS, Azure, or on-premise depending on your choice). The second is the two model partners that handle LLM inference (Anthropic) and voice synthesis (ElevenLabs). This page lists every one, names the role, the jurisdiction, the contract type, and the exact data each party sees.

The current list and a current DPA are available on request through contact. The list below covers the default Cloudflare deployment. For AWS, Azure, or on-premise variants, the substrate row changes; the other rows remain identical.

Role: All LLM inference calls in the enrichment pipeline. Intelligence extraction, quote cleanup, brand-perception mapping, quality audit, and translation nodes call the Claude model family.

Jurisdiction: United States (Delaware corporation, San Francisco operations). The Anthropic API is served from US data centers by default. Regional routing is available for Enterprise customers with specific residency needs.

Contract type: Anthropic API Terms of Service with the no-training compliance amendment, on every plan. Enterprise additionally signs the Anthropic Zero Retention Policy amendment, which removes the request-side persistence at Anthropic.

What Anthropic sees per call: the rendered system prompt (a pipeline-version-locked template), the cleaned transcript chunks the enrichment node is asked to process, and the model identifier. The respondent identifiers and any items on your redaction list are stripped from the chunks before they leave your tenant.

Role: Two flows. The live interview agent uses ElevenLabs to render the agent’s voice and to transcribe the respondent. The post-interview synthesis pass uses ElevenLabs to render the synthetic voice substitution that produces the anonymized audio record.

Jurisdiction: United States (Delaware corporation, New York operations). EU data residency is available for customers under GDPR.

Contract type: ElevenLabs Enterprise agreement with the no-training and no-retention amendments, on every plan and every tier. The original respondent audio does not persist at ElevenLabs after the call. No training is performed on customer voice content.

What ElevenLabs sees per call: the respondent audio stream during the live interview, and the cleaned transcript during the synthesis pass. Both flows are short-lived. No copy is retained.

Role: On the default deployment, every piece of platform infrastructure runs on Cloudflare. Workers, R2 object storage, Durable Objects, Queues, and the DDoS and attack-protection edge layer. Cloudflare is also the substrate that fronts this website for attack and DDoS protection.

Jurisdiction: United States (Delaware corporation, global operations). Cloudflare offers EU jurisdiction isolation for R2 buckets (the eu jurisdiction flag) and Durable Object location hints that pin compute and storage to a specified region.

Contract type: Cloudflare Workers and R2 Enterprise agreement under the customer’s account. The customer owns the account; Nexa operates within it under the deployment contract. Cloudflare’s standard DPA and sub-processor list apply to the customer’s Cloudflare account directly.

What Cloudflare sees: the entire platform’s traffic and storage, as the substrate hosting it. The Cloudflare contract on the customer’s account governs access. Encryption at rest is AES-256 by default; customer-managed keys are available on request.

For deployments on AWS, Azure, or on-premise infrastructure instead of Cloudflare, the substrate row above is replaced with the customer’s chosen provider. The customer’s direct contract with AWS, Azure, or their internal IT covers the substrate. Nexa operates under the deployment contract on top of the customer’s substrate.

For air-gapped on-premise deployments where Anthropic and ElevenLabs cannot be reached, on-premise inference and on-premise voice synthesis variants exist. The trade-off is the quality of the interview agent and the cost per conversation. The contract names the substitution.

Role: Operating the Cloud Harness inside your account. Deploying releases, running incident response, tuning enrichment, calibrating the per-dimension half-lives against your corpus, watching observability.

Jurisdiction: Quebec, Canada. Operating entity: Life and Logic / NexaStaff. Address and registration available on request.

Contract type: The deployment and operating contract between Nexa and the customer. The DPA, the consent flow, the redaction-list configuration, and the refusal protocol all sit under this contract.

What Nexa sees: operational access to the platform running on your account, scoped to the surfaces we need to operate. We do not export data. We do not run training. We do not aggregate across customers.

Adding a subprocessor requires customer notification. The notification names the role, the jurisdiction, the contract type, and the data the new party would see. The customer can object before the addition takes effect. Enterprise contracts include a stronger right of approval on additions that touch customer-content data flows.

Removing a subprocessor (for example, replacing the LLM partner) is a configuration change inside your tenant. The corpus and the methodology are designed against the open schema, so replacing a partner is a code change against the published spec.