Subprocessor Register
Operator: Urbano DX (EU / Poland) Contact: urbano@urbanodx.com Last updated: 2026-07-14
This register lists the third parties Urbano DX commonly engages to help deliver and operate software for clients. Not every engagement uses every subprocessor: the specific list for an engagement is agreed with the client and recorded in that engagement's Data Processing Agreement, Annex III. This document is the general reference behind that annex and is referenced by the Trust and Security overview.
We give clients prior notice before adding or replacing a subprocessor that processes their personal data, and the opportunity to object, as set out in the DPA.
AI and model inference
| Subprocessor | Purpose | Data it may receive | Region / transfer basis |
|---|---|---|---|
| MiMo (Xiaomi), AMS endpoint | Text generation and reasoning (primary model) | Prompt content: the task inputs a feature sends (text to draft, summarise, classify, or extract) | Amsterdam (EU) API endpoint |
| OpenAI | Speech to text, text to speech, and vision where a feature needs them | Audio, images, and prompt content for that feature | US; SCCs |
| Jina AI | Text embeddings for semantic search | Text to be embedded | Provider region; SCCs |
| Vapi | Voice-agent orchestration where an engagement includes a voice interface | Call audio, transcripts, caller number, conversation content | Provider region; SCCs |
We do not use client or end-user data to train models. The providers above are used over their standard API terms.
Platform and infrastructure
| Subprocessor | Purpose | Data it may receive | Region / transfer basis |
|---|---|---|---|
| Cloudflare | DNS, TLS termination, tunnel, access control, object storage | Request metadata and stored files | Global edge; SCCs / DPA |
| Firebase (Google Cloud) | Authentication and identity | Email, name, auth identifiers | US / multi-region; SCCs |
| Stripe | Payments and billing | Name, email, billing details, payment tokens | US / EU; SCCs; PCI-DSS handled by Stripe |
| Resend | Transactional email delivery | Recipient email, message content | US; SCCs |
| Beehiiv | Newsletter delivery where an engagement includes one | Subscriber email, engagement data | US; SCCs |
| Hetzner Online GmbH | Application and database hosting | Application data at rest | Nuremberg, Germany (EU) |
| Self-hosted infrastructure (Kraków, Poland) | Selected internal workloads | Application data for hosted workloads | Poland (EU) |
Analytics
| Subprocessor | Purpose | Data it may receive | Region / transfer basis |
|---|---|---|---|
| Plausible / GA4 | Website analytics | Pseudonymous usage metrics | EU (Plausible) / US (GA4); SCCs for GA4 |
International transfers outside the EEA rely on the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, an adequacy decision, together with supplementary technical measures (encryption in transit, data minimisation, and the sanitisation described in the AI Governance Framework).