Subprocessor Register
Last updated: June 17, 2026
This page lists the third-party providers (subprocessors) that process personal data on behalf of Wynex Labs to deliver the Atlas service. The list mirrors our internal DPA register and serves both self-serve users (read directly) and institutional customers (referenced as Annex 1 of the signed DPA).
| Subprocessor | Purpose | Region (live) | Transfer mechanism |
|---|---|---|---|
| Google LLC — Vertex AI | LLM inference on student & course content — grading (essays and Excel), AI tutor and document chat, study guides, question generation and answer explanations, content classification, and knowledge-map and document-processing utilities (Gemini 2.5 / 3.5 Flash and Flash-Lite variants) | EU (europe-west4 Netherlands + eu multi-region) | EU inference for supported Gemini models in the EU multi-region; any transfer outside the EEA governed by EU SCCs (Google Cloud DPA) |
| Anthropic PBC — DECOMMISSIONED (2026-06-15) | Decommissioned (2026-06-15); no data flow. Formerly Claude essay grading / generation, replaced by Google Vertex AI (EU). | n/a — no longer in use | n/a — no data processed |
| OpenAI LLC (via Microsoft Azure-OpenAI-EU — primary) | Document embeddings (text-embedding-3-small) | EU (swedencentral — EU Data Zone) | EU (Sweden Central / EU Data Boundary); any transfer outside the EEA under EU SCCs (Microsoft Online Services DPA); zero-retention |
| OpenAI LLC (direct) — DECOMMISSIONED (2026-06-15) | Decommissioned (2026-06-15); no data flow. Formerly a config-gated fallback embedding path, removed when embeddings consolidated onto the Azure-OpenAI-EU path. | n/a — no longer in use | n/a — no data processed |
| Mistral AI | OCR (mistral-ocr-latest) + knowledge-map generation (Mistral Large 3, La Plateforme) | EU (Sweden primary, Ireland backup) | EU by default (primary Sweden, backup Ireland); certain features may transfer outside the EEA under EU SCCs (Module 4) per Mistral's DPA |
| Vercel Inc. | Hosting, Functions, Blob storage | US (sea1 + iad1) | SCCs |
| Vercel Analytics | Product analytics (cookieless, no consent required) | US | SCCs |
| Neon Inc. | Postgres database (primary) | EU (eu-central-1) | EU-only |
| Resend Inc. | Transactional email (OTP, DSR, notifications) | US | DPF + SCCs |
| Google LLC | OAuth identity provider (sign-in only) | US | DPF + SCCs under Google OAuth ToS |
| Microsoft Corporation — Azure AD | OAuth + SSO for institutional customers | Per tenant region | DPF + SCCs under Microsoft Online Services DPA |
| Sentry (Functional Software Inc.) | Error monitoring | EU (Germany) | EU data residency (Sentry EU region); PII masking enabled |
We provide 30 calendar days' prior notice before adding or replacing any subprocessor. Self-serve users are notified by email; institutional customers are notified through the DPO contact on file from the signed DPA.