Sub-processors
This page lists the sub-processors used by Mortem AI Inc. to deliver our Services, together with their function and processing locations. This list is maintained in alignment with Schedule E.3 of our Master Service Agreement and is updated as our sub-processor relationships change.
Advance notice of changes. Customers receive thirty (30) days advance written notice of additions, substitutions, or removals of sub-processors that process Client Data, in accordance with our contractual commitments. Customers who object to a proposed change may exercise the rights set out in their signed agreement.
Current sub-processors
The following entities process personal information on Mortem AI's behalf to deliver the Services described in our agreement with you. All sub-processors are subject to data protection terms substantially equivalent to those Mortem AI commits to under our Master Service Agreement.
| Sub-processor | Purpose | Data categories | Processing location |
|---|---|---|---|
| OpenAI, Inc.Production AI inference | Generation of conversational Output via the OpenAI API. Provider has contractually committed not to use API inputs or outputs to train its models. | Conversation content, end-user prompts and responses | United States |
| Anthropic, PBCBenchmarking only | Internal evaluation and quality benchmarking of model performance. Not used in production runtime. | Synthetic and Mortem AI-controlled evaluation data only | United States |
| GoHighLevel LLCCRM and workflow | Customer relationship management platform, contact records, workflow automation, calendar booking, and email and SMS delivery routing. | Contact details, conversation metadata, calendar events, workflow state | United States |
| Twilio Inc.SMS and messaging | Telephony, SMS and MMS message delivery, phone number provisioning, A2P 10DLC registration, and toll-free verification. | Phone numbers, message content, message metadata | United States |
| Supabase, Inc.Database and vector store | Primary application database (PostgreSQL), retrieval-augmented generation vector store (pgvector), file storage, and authentication services. | Conversation transcripts, contact records, configuration data, RAG document embeddings | United States Canadian region available |
| Vercel, Inc.Frontend hosting | Hosting and edge delivery of the Mortem AI customer dashboard, onboarding portal, and Sarah AI chat widget embeddable on customer websites. | Page request metadata, browser fingerprints, customer login sessions | United States |
| Render, Inc.Backend services hosting | Hosting and runtime infrastructure for Mortem AI's backend FastAPI services that power Sarah AI and the communications platform. | API request data, application logs, runtime environment data | United States |
| Doppler, Inc.Secrets management | Centralised secrets management with audit logging for all production API keys, database credentials, and webhook signing secrets. | Credential metadata only (no Client Data) | United States |
| Google LLCWorkspace, Calendar, Drive | Google Workspace and document management for Mortem AI internal use. Google Calendar API integration with customer calendars where authorised by the customer. | Customer-authorised calendar event data, internal Mortem AI operational documents | United States and global |
| Stripe, Inc.Payment processing and billing | Payment processing, subscription billing, invoice generation, and PCI-compliant payment card handling for Mortem AI customer accounts. | Customer billing contact details, payment method metadata (Stripe stores card data directly; Mortem AI never stores full card numbers) | United States |
Infrastructure providers (not data processors)
The following providers support Mortem AI's operations but do not process Client Data as defined in our agreements:
- Aikido: Code security scanning and vulnerability management (scans Mortem AI source code, not Client Data)
- GitHub: Source code repository hosting (Mortem AI source code, not Client Data)
- Bitwarden: Password management for Mortem AI internal team credentials
- Wise: International contractor payments by Mortem AI
How we evaluate and onboard new sub-processors
Before engaging a new sub-processor that will process Client Data, Mortem AI conducts a review covering:
- Information security posture, including encryption, access controls, and incident response capability;
- Data protection terms, including a data processing agreement at least as protective as our commitments to customers;
- Processing location, particularly where customer data is subject to data residency or cross-border restrictions;
- Service reliability and uptime track record;
- Compliance certifications (such as SOC 2, ISO 27001, where applicable);
- Sub-processor's own sub-processors (chain of processing).
Cross-border processing and Canadian residents
Most of Mortem AI's sub-processors are based in or process data in the United States. For Canadian residents:
- Mortem AI maintains administrative, technical, and contractual safeguards designed to provide a level of protection for personal information processed outside Canada substantially comparable to that required under PIPEDA (Principle 4.1.3 of Schedule 1);
- For Alberta residents, additional information about our cross-border processing policies and the contact information of foreign service providers is available on request, per Section 13.1 of Alberta's Personal Information Protection Act;
- For customers requiring Canadian-region hosting (for example, to support compliance with Quebec Law 25 obligations), Canadian-region Supabase hosting is available on commercially reasonable terms agreed in the applicable order form.
Notifications and objections
Customers receive thirty (30) days advance written notice of additions, substitutions, or removals of sub-processors that process Client Data. Notice is sent to the customer's designated administrative contact as recorded in the signed agreement, and is also reflected on this page.
Customers who object to a proposed sub-processor change may exercise the rights set out in their signed agreement, which typically include the right to terminate the affected portion of the Services if Mortem AI cannot reasonably accommodate the objection.
To subscribe to sub-processor change notifications independently of your signed agreement, email [email protected] with the subject line "Sub-processor notifications" and we will add you to the notification list.
Contact
For questions about this list, sub-processor agreements, or data residency:
Mortem AI Inc.
1717 Devney Drive
Altoona, Wisconsin 54720
United States
Privacy queries: [email protected]
Security queries: [email protected]