Authorized Sub-Processors

Last Updated: August 5, 2026 | Effective: May 5, 2026

This page lists AI Bizlutions's authorized sub-processors as referenced in our Data Processing Agreement (Annex B, Section 4.4). Changes to this list will be communicated with at least 30 days' advance notice per our contractual obligations under GDPR Article 28(2).

The Customer has provided general written authorization for the sub-processors listed below. If you wish to object to a new sub-processor, you may do so within 30 days of notification per DPA Section 4.4.

Sub-Processor Purpose Location Safeguards
Amazon Web Services, Inc. Cloud infrastructure, database, file storage, compute US-East-2 (Ohio) AWS DPA, SOC 2 Type II, ISO 27001
Amazon Web Services (SES) Transactional and campaign email delivery US-East-1 AWS DPA, SOC 2 Type II, ISO 27001
Google LLC (Gemini AI) AI content generation, entity analysis, document processing United States Google Cloud DPA, SCCs
Stripe, Inc. Payment processing, subscription management United States PCI DSS Level 1, Stripe DPA, SCCs
Replicate, Inc. AI media/video generation United States DPA, ephemeral processing
Meta Platforms, Inc. Social media publishing (Facebook/Instagram) — user-initiated only United States Meta Platform Terms, SCCs
LinkedIn (Microsoft) Social media publishing — user-initiated only United States/Ireland LinkedIn DPA, SCCs
Microsoft Corporation Email sync, calendar integration — user-initiated only United States/Ireland Microsoft DPA, SCCs
Intuit Inc. (QuickBooks) Accounting/invoice sync — user-initiated only United States Intuit DPA, SOC 2
Google LLC (Gmail API) Outbound email sending (OAuth, send-only) — sender identity and outbound message content; user-initiated only United States Google Cloud DPA, SCCs

Sub-Processor Agreements (Contractual Chain)

AI Bizlutions maintains data processing agreements with all sub-processors listed above, either through standard service agreements that incorporate DPA terms or through explicit data processing addenda. The following table documents the specific contractual basis for each sub-processor relationship per GDPR Article 28(2)-(4) and CCPA §1798.140(ag).

Sub-Processor Agreement Type GDPR Art. 28 Basis CCPA Service Provider Certification Reference URL
Amazon Web Services, Inc. AWS Data Processing Addendum (auto-applies under AWS Customer Agreement) Incorporated by reference; includes SCCs Module 2 AWS certifies it will not sell/share PI; processes only per documented instructions AWS DPA
Google LLC (Gemini AI) Google Cloud Data Processing Terms (accepted via API ToS) Google Cloud DPA with SCCs; sub-processor list at privacy.google.com Google certifies processing only for service provision; no selling/sharing PI Google Cloud DPA
Stripe, Inc. Stripe Data Processing Agreement (auto-applies to all Stripe accounts) Stripe DPA with SCCs; PCI DSS Level 1 certified Stripe certifies service provider status; processes PI only for payment services Stripe DPA
Replicate, Inc. Replicate Terms of Service with Data Processing provisions Processing limited to ephemeral inference; no data retention post-processing Replicate processes inputs only for inference output; no retention, no selling Replicate Privacy
Meta Platforms, Inc. Meta Platform Terms §3.a (Data Processing) User-initiated data sharing only; Meta Platform Data retention ≤120 days Processing limited to social publishing at user direction Meta Platform Terms
Microsoft Corporation (incl. LinkedIn) Microsoft Products and Services Data Protection Addendum Microsoft DPA with SCCs; ISO 27001/27018 certified Microsoft certifies service provider status per CCPA; no selling PI Microsoft DPA
Intuit Inc. (QuickBooks) Intuit Data Processing Agreement Intuit DPA with processing scope limited to accounting sync Intuit certifies service provider status; SOC 2 Type II certified Intuit DPA
CCPA §1798.140(ag) Compliance: All sub-processors listed above are contractually prohibited from: (a) selling or sharing personal information received from AI Bizlutions, (b) retaining, using, or disclosing PI outside the direct business relationship, (c) combining PI with data from other sources except as permitted by CCPA. These restrictions are incorporated via each provider's standard DPA or service agreement terms.
GDPR Art. 28(2)-(4) Compliance: AI Bizlutions has obtained general written authorization from data subjects (via DPA §4.4) for the sub-processors listed above. New sub-processors are subject to 30-day advance notification. Each sub-processor agreement imposes the same data protection obligations as contained in our DPA with customers. AI Bizlutions remains liable for the performance of its sub-processors.

Supplier Security Risk Assessments (ISO 27001 A.5.19)

AI Bizlutions conducts formal security risk assessments for all sub-processors prior to engagement and on an annual basis thereafter. Assessments evaluate data access scope, security certifications, incident history, and contractual protections. Risk levels drive review frequency: High-risk suppliers are reviewed semi-annually; Medium-risk annually; Low-risk biennially.

Sub-Processor Risk Level Data Categories Processed Security Controls Verified Last Assessment Next Review Due
Amazon Web Services, Inc. High All customer data (PII, business data, files) SOC 2 Type II, ISO 27001, ISO 27017, ISO 27018, FedRAMP, encryption at rest (AES-256), encryption in transit (TLS 1.2+) May 2026 November 2026
Amazon Web Services (SES) High Email addresses, email content, metadata SOC 2 Type II, ISO 27001, DKIM/SPF/DMARC enforcement, bounce/complaint processing, encryption in transit May 2026 November 2026
Google LLC (Gemini AI) High Prompts containing business content and personal/business names, plus AI-generated outputs. Email addresses, telephone numbers, government identifiers and payment card numbers are removed before transmission; names are not. SOC 2 Type II, ISO 27001, no training on API data (Gemini API ToS §4), ephemeral processing, contact-detail redaction pre-transmission (email, telephone, government identifiers, card numbers) May 2026 November 2026
Stripe, Inc. High Payment card data, billing information, customer email PCI DSS Level 1, SOC 2 Type II, tokenization (no raw card data touches our systems), fraud detection, encryption May 2026 November 2026
Replicate, Inc. Medium AI prompts, generated media (ephemeral) Ephemeral processing (no data retention post-inference), TLS in transit, no model training on inputs May 2026 May 2027
Meta Platforms, Inc. Medium Social post content, page tokens (user-initiated) OAuth 2.0, 120-day data retention cap (Meta Platform Terms §3.d), token encryption at rest, SSRF validation on URLs May 2026 May 2027
Microsoft Corporation (incl. LinkedIn) Medium Email content, calendar data, social posts (user-initiated) SOC 2 Type II, ISO 27001, ISO 27018, OAuth 2.0 + PKCE, DPA with SCCs, encryption at rest and in transit May 2026 May 2027
Intuit Inc. (QuickBooks) Medium Invoice data, customer financial records (user-initiated) SOC 2 Type II, OAuth 2.0, sandbox/production separation, data minimization (sync only requested entities) May 2026 May 2027
Risk Assessment Methodology: Risk levels are determined by: (1) Data sensitivity — volume and classification of personal data accessed; (2) Access scope — breadth of system access (infrastructure vs. single-purpose API); (3) Retention duration — how long the supplier retains data; (4) Certification posture — independent audit attestations held. High-risk suppliers process all customer data or handle payment/infrastructure. Medium-risk suppliers handle limited data categories with user-initiated access only. Assessment records are maintained for audit purposes per DPA §5.2.

Subscribe to Changes

To receive advance notice of sub-processor changes, email dpo@aibizlutions.com with the subject line "Sub-processor notifications".

Change History

Date Change
August 5, 2026 Added Google LLC (Gmail API) for outbound email sending on the customer’s behalf
May 20, 2026 Added Supplier Security Risk Assessments section (ISO 27001 A.5.19 compliance)
May 19, 2026 Added Sub-Processor Agreements section documenting contractual chain (GDPR Art. 28, CCPA §1798.140(ag))
May 5, 2026 Initial sub-processor list published
Contact:
Data Protection Officer
Email: dpo@aibizlutions.com
AI Bizlutions, LLC, PO Box 717, Queen Creek, AZ 85142, USA

Related Documents