This Sub-processor List reflects the third parties that process Customer Data for the Services as of the Effective Date above. A provider is approved to process Customer Data or nonpublic personal information only where its row states "Approved" in the NPI-approved column and Company has verified written data-protection terms for that provider.
Intelligent Systems LLC uses the third-party providers below to help deliver the Services. Each provider processes data only to provide its services to us and is bound by contractual confidentiality and data-protection obligations. For production use of the Services, we require each provider that processes Customer Data on our behalf to enter into written terms that include confidentiality and data-protection obligations materially consistent with those in our Data Processing Addendum. The descriptions below reflect our current configurations and contractual arrangements with each provider. The statements in this list apply only to the configurations and written terms Company verifies and enables for production. Before enabling any provider to process Customer Data, Company will confirm the provider's legal name, processing locations, retention terms, training and use restrictions, and data-protection agreement, and will update this list and related documentation if those terms or settings change in a way that affects how Customer Data is processed.
Current Sub-processors
| Provider | Legal entity | Service | Data categories | Processing locations | Customer Data retained? | Training use | DPA/SCCs in place | NPI approved? |
|---|---|---|---|---|---|---|---|---|
| Supabase | Supabase, Inc. | Database and per-tenant data hosting (a separate tenant per Customer) | Customer Data, account data | United States | Yes | No | Yes (Supabase standard DPA) | Approved |
| Vercel | Vercel Inc. | Application hosting and delivery | Usage and request data, account data | United States | Limited retention in logs and telemetry only; no persistent storage of database content | No | Yes (Vercel standard DPA) | Not approved |
| Anthropic | Anthropic, PBC | AI model provider (Claude) for AI features | Queries and content sent for AI features | United States | Up to 7 days of API logs; none with Zero Data Retention enabled | No (does not train on Customer Data under Anthropic Commercial Terms) | Yes (Anthropic Commercial Terms and DPA) | Approved |
Scroll table sideways to see more
Other Providers
We also use GitHub (GitHub, Inc.) for source-code hosting and development tooling. GitHub is not intended to process Customer Data and is therefore not listed as a sub-processor; we treat any incidental exposure as a security incident. We will update this list before any new sub-processor begins processing Customer Data.
How to Receive Change Notices
To be notified of new or replaced sub-processors, contact info@orbitcrm.ai to subscribe. We will provide notice before a new sub-processor begins processing Customer Data, and customers may object on reasonable data-protection grounds as described in the Data Processing Addendum.