Subprocessors

Version: 1.0 Last updated: 2026-05-04 Public URL when live: https://meandai.io/legal/subprocessors

This page lists every third party that meandai engages to process personal data on behalf of customers, in fulfilment of Article 28(2) and (4) GDPR and the Data Processing Agreement §7. The list is normative: every subprocessor that touches customer data is named here, with the country, purpose, and DPA URL.

Notification policy

We give all active customers at least 30 days' prior notice of any new or replacement subprocessor by:

1. Email to the customer's primary contact, and
2. Update of this page (the public URL is RSS-watchable for customer compliance teams), and
3. In-app changelog entry under Settings → Compliance.

Within that 30-day window, a customer may object on documented data-protection grounds. If the parties cannot agree on a reasonable alternative within a further 30 days, the customer may terminate the affected services without penalty per DPA §7.2.

Categories

A. Infrastructure

B. Platform services

C. AI model providers

These are routed via the shared-llm package, with per-tenant model preference and per-call telemetry. We have a contractual commitment from each that customer data submitted via inference calls is not used to train any model and is retained only as required to provide the API response.

D. Observability

E. Marketing channels (tenant-connected only)

These subprocessors only receive personal data if the customer connects them. They are listed here for transparency but are not engaged by default.

F. Insurance and professional services

These are not "subprocessors" in the strict GDPR sense (they do not process personal data on our instructions to provide the platform), but they are listed for transparency because they may receive incident-related personal data.

G. Region map

A summary of where each subprocessor's primary processing occurs:

EU primary (default)        : Neon, Neo4j Aura, Cloudflare R2, Railway, AWS KMS,
                              Resend, Clerk, Logfire, PostHog, Paddle, Better Stack
US primary                  : Anthropic, OpenAI, fal.ai, Inngest (metadata only),
                              Doppler (system secrets only)
EU primary, US data-sharing : Cloudflare edge (global), Buffer/Meta/LinkedIn (tenant-connected)

H. Cross-border transfer mechanisms

Where a subprocessor primarily operates outside the EEA, the legal mechanism for transfer is documented per-subprocessor:

• Anthropic, OpenAI, fal.ai — EU Standard Contractual Clauses 2021/914 Module Two + transfer impact assessment (TIA). Anthropic and OpenAI also rely on the EU-US Data Privacy Framework (DPF) where adequacy is in force.
• Inngest, Doppler — EU SCCs 2021/914 Module Two; data sent is metadata/system credentials, not customer personal data.
• Telegram, Buffer, Meta, LinkedIn, TikTok — relevant SCCs and the subprocessor's own DPA, executed at the moment the customer connects the integration.

A copy of the executed SCCs and TIAs is available on customer request via privacy@meandai.io.

I. Subprocessor change history

Internal note — Track 9 / Wave 19:

Paddle is listed as Live-target because Paddle KYC + integration is Track 3 work. Until Paddle is connected, Stripe Connect (US) may be the interim payments processor; if so, this list must be updated and 30 days customer notice given before LIVE flip. Drata Foundation (compliance evidence) is not a subprocessor — it ingests platform metadata (Doppler audit log, Clerk audit log) but does not see customer personal data; it is listed as a recipient in the AUP §4 enforcement evidence trail, not here.