Subprocessors
AETERNUM AI LLC — WorkHeroes OS
Version 1.0 · Last updated 7 September 2026
This page lists the third parties that process personal data on our behalf in order to deliver WorkHeroes OS. It forms Annex III of our Data Processing Agreement.
Each of them is bound by a written contract with data protection obligations materially equivalent to those we owe our customers, and we remain fully liable for their performance.
Notice of changes. We announce any new or replacement subprocessor at least 30 days in advance, by email to each customer's administrative contact and by updating this page. Customers may object on reasonable data-protection grounds, as set out in clause 6.4 of the DPA. To receive these notices, write to [email protected].
1. Core infrastructure — always in use
| Subprocessor | Function | Data processed | Processing location | Transfer mechanism |
|---|---|---|---|---|
| Supabase, Inc. | Database, file storage, authentication | All Customer Data at rest; account credentials | European Union | Data at rest in the EU; SCCs for support access from outside the EEA |
| Vercel, Inc. | Application hosting, serverless execution, CDN | Data in transit while a request is processed; request logs | Function execution in Frankfurt (fra1), European Union. The delivery network serves static content from global nodes and request logs are processed in the United States | SCCs |
| Zoho Corporation | Outbound email from the platform (SMTP) | Recipient address, subject and message content, attachments | European Union (smtp.zoho.eu) | Processing within the EU |
2. AI features — in use when the customer enables them
| Subprocessor | Function | Data processed | Processing location | Transfer mechanism |
|---|---|---|---|---|
| Alibaba Cloud (Model Studio / Qwen) | Text generation, audio transcription, image editing | Prompts and the extracts of Customer Data they contain | Frankfurt, European Union (eu-central-1) | Processing within the EU |
No other AI provider processes data belonging to customers established in the European Economic Area. The platform technically supports other model providers, but the production configuration for European customers uses Qwen in Frankfurt exclusively, both as the primary and as the fallback provider. Should it ever become necessary to use a provider outside the EU, this would be announced thirty (30) days in advance under clause 6.4 of the DPA, with a right to object.
AI features can be disabled at workspace level.
3. Communication channels — in use when the customer activates them
| Subprocessor | Function | Data processed | Processing location | Transfer mechanism |
|---|---|---|---|---|
| Telegram | Messaging channel between the workspace and its users | Message content, Telegram identifiers of the linked users | Outside the EEA | The channel is activated by the customer with the customer's own bot and under the customer's own relationship with Telegram; the customer decides what information travels through it |
| Meta Platforms (WhatsApp Business API), via the integration partner Zernio | WhatsApp channel | Message content, telephone numbers | United States / EEA | SCCs of the respective providers |
Integrations are disabled by default. None of them processes data until the customer activates it with its own credentials.
4. Not subprocessors
For clarity, we do not use: advertising networks, third-party web analytics, data brokers, CRM enrichment services, or session-recording tools. Web fonts are served from our own domain, so rendering a page does not disclose the visitor's IP address to a font provider.
5. Aeternum personnel and contractors
Our own staff and contractors access Customer Data only where necessary for support, operation or maintenance, from the United States and the European Union. They are bound by confidentiality obligations that survive the end of their engagement, and their access is logged.
6. Contact
Questions about this list, or to subscribe to change notifications: [email protected].