Sub-Processors
Annex II of the Data Processing Agreement
Last updated: October 28, 2026
1. Where your account is hosted
Each Customer account is hosted in one AWS region, chosen when the account is created. Customer data is stored and processed in that region, except where the tables below say otherwise.
| Region | Address | Processing outside the hosting region |
|---|---|---|
| US East (us-east-1, N. Virginia, United States) | atlanticma.ai | AI inference through AWS Bedrock may route within the AWS US regions us-east-1, us-east-2 and us-west-2. Our operations monitoring workspace in London (eu-west-2) reads service metrics and application logs. |
| London (eu-west-2, United Kingdom) | eu.atlanticma.ai | CloudFront edge access logs (visitor IP address, browser user agent, requested URL) are stored in us-east-1 for 365 days. The optional meeting notetaker (Recall.ai), where enabled, processes in eu-central-1 (Frankfurt). AI inference stays in eu-west-2. |
We do not host Customer accounts in any other region.
2. Sub-processors
| Sub-Processor | Purpose | Location | Safeguards |
|---|---|---|---|
| Amazon Web Services, Inc. and Amazon Web Services EMEA SARL | Hosting: compute, database, file storage, CDN, encryption keys, secrets, monitoring | The account's hosting region (us-east-1 or eu-west-2). CloudFront edge access logs: us-east-1. | SOC 2 Type II, ISO 27001; SCCs + DPF |
| Amazon Bedrock (AWS), with Anthropic Claude and DeepSeek models | AI features: transcript analysis, work plan generation, dependency analysis, report writing. Invoked as an AWS service, never through the model providers' own APIs. Not used for model training. | US East accounts: us-east-1, and may route within us-east-2 and us-west-2. London accounts: eu-west-2 only. | SOC 2 Type II, ISO 27001; SCCs + DPF |
| Amazon SES (AWS) | Transactional email | The account's hosting region (us-east-1 or eu-west-2) | SCCs + DPF |
| Recall.ai, Inc. | Meeting notetaker, read-only calendar sync and real-time transcription. Off by default; enabled per project by the Customer. | US East accounts: us-east-1. London accounts: eu-central-1 (Frankfurt). | SOC 2 Type II; SCCs + DPF |
| Paddle.com Market Ltd | Merchant of Record for subscription billing. Billing contact data only; no access to platform data. | UK, with US redundancy | PCI DSS Level 1; UK adequacy + SCCs |
| Wise Payments Ltd | Payouts to practitioners under revenue share. No Customer platform data. | UK | UK adequacy; SCCs where applicable |
| Track1099 (Avalara, Inc.) | US tax forms for US practitioners. Activates only on the first US practitioner payout. No Customer platform data. | US | SCCs |
| GitHub, Inc. | Source code hosting and CI. No customer personal data. | US | SOC 2 Type II; SCCs + DPF |
3. Services the Customer connects
Data reaches these services only when a user or an account administrator connects their own account to the platform, on the Customer's instruction. Nothing is sent to them otherwise. Because the Customer chooses to connect them, they are not sub-processors engaged by us, and connecting one does not trigger the notice in Section 4.
| Service | What it does | Connected by | Location |
|---|---|---|---|
| Microsoft Corporation and Microsoft Ireland Operations Ltd (Graph API) | Meeting invitations from the user's calendar; reading the user's inbox for the project inbox; Teams delivery and Teams transcripts | A user (own Outlook mailbox and calendar) or an admin (Teams, through the Customer's own Azure app) | The Customer's Microsoft region |
| Google LLC (Gmail and Google Calendar APIs) | Meeting invitations from the user's calendar; reading the user's inbox for the project inbox | A user (own mailbox and calendar) | Google's regions |
| Atlassian (Jira Cloud API) | Two-way sync of work plan tasks with Jira issues | An account admin (the Customer's own Jira site) | The Customer's Jira Cloud region |
| Slack Technologies LLC | Slack delivery of compositions | An account admin (incoming webhook) | US |
4. Changes
We give at least 30 days' notice before a new sub-processor begins processing Customer personal data, by email to each account's primary administrator and on this page. The Controller may object within that period, as set out in Section 3.4 of the Data Processing Agreement.
5. Contact
Questions about this list: privacy@atlanticma.ai
Lamb and Flag TopCo Corp (dba AtlanticM&A) · 159 N Wolcott St, Ste 133, Casper, WY 82601, United States