Annex Orbis1. Infrastructure
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Vultr (The Constant Company, LLC) | Cloud servers for applications and databases | All Customer Content and account data stored in our databases | United States |
| RamNode | Email servers that receive and send mail for hosted mailboxes | Email messages and their metadata while in transit | United States |
| Amazon Web Services, Inc. (Amazon Simple Email Service and Amazon S3) | Sends and receives email for hosted mailboxes; received messages are held briefly in Amazon S3 until we store them. Like other email providers, it may store and scan messages to block spam, phishing and malware. | Email messages, their senders, recipients and metadata | United States (US East, Ohio) |
| Cloudflare, Inc. | Content delivery, TLS, DDoS protection, website and application hosting, and object storage for files, email originals, chat, recordings and encrypted backups | All traffic to the Services; stored files and objects | United States headquarters; global network |
2. Communications
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Telnyx LLC | Phone numbers, voice calls, SMS and MMS, messaging registration, call recording and speech transcription | Phone numbers, call audio and recordings, message content, business registration details | United States |
| Cloudflare, Inc. (RealtimeKit) | Video meetings, and meeting recording, transcription and summaries when enabled | Meeting audio and video, participant names, recordings and transcripts | United States headquarters; global network |
| Google LLC (Firebase Cloud Messaging) | Push notifications to the Android phone and tablet apps | Device push tokens and notification content | United States |
| Apple Inc. (Apple Push Notification service) | Push notifications to the iPhone and iPad apps | Device push tokens and notification content | United States |
3. Artificial intelligence
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Google LLC (Gemini API) | Language model for the HAL assistant: works out HAL's answers and the steps HAL takes. Not used to train Google's models. | What you say and type to HAL, conversation history, memory notes, and Customer Content HAL looks up to answer you | United States |
| OpenAI | Live spoken conversations with HAL: hears what you say and speaks HAL's replies | Voice audio, what you say, and HAL's spoken replies | United States |
| Anthropic, PBC | Language model for work agents an organization sets up and for improvement requests; not used for HAL conversations | The agent's instructions and the Customer Content it is given to do its work | United States |
| TypeSafe AI, Inc. | Typed page selection for HAL navigation | The user's navigation command, current page label, and the app's page directory; not retrieved Customer Content or conversation history | United States |
| xAI | Turns voice messages to HAL into text, and reads HAL's replies aloud in the voice you choose | Voice audio and HAL's reply text | United States |
| Google LLC (Gemini API) | Optional advanced email protection, only for mailboxes where an administrator turns it on: checks new messages from outside the organization for phishing, payment fraud and harmful attachments. Not used to train Google's models. | Those messages, their attachments, sender details and authentication results | United States |
4. Mapping and financial data
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| HERE Global B.V. | Maps, geocoding, routing, route planning and turn-by-turn navigation | Addresses, coordinates, stops, time windows, vehicle details and driver location during navigation | Netherlands and United States |
| Plaid Inc. | Connecting Customer bank accounts and importing transactions | Bank account names, masks and types; transactions | United States |
HERE's own handling of the information it receives is described in the HERE Privacy Notice.
5. Services you choose to connect
When you connect your own account with a third party, that provider acts for you under your agreement with it, not as our sub-processor. Examples: a Stripe account used to collect invoice payments, a payroll provider (such as Gusto, Rippling or ADP) whose records you import, and the consumer reporting agency you engage for background screening.
6. Changes to this list
We update this page before a new sub-processor begins processing Customer Content. Customers who want notice of changes by email can ask privacy@annexorbis.com; objections are handled as described in our Data Processing Addendum.
Added October 19, 2026: Amazon Web Services, Inc. (Amazon Simple Email Service), to send outgoing email for hosted mailboxes. It will not send Customer email before November 4, 2026. RamNode stays on this list until our move off its servers is complete.
Changed October 19, 2026: Amazon Web Services will also receive incoming email for hosted mailboxes (Amazon SES receiving, with messages held briefly in Amazon S3), replacing RamNode. It will not receive Customer email before November 4, 2026. RamNode will then be removed from this list.
Added October 21, 2026: Google LLC (Gemini API), for optional advanced email protection. It processes only messages to mailboxes whose administrator turns advanced protection on.
Corrected October 28, 2026: this list now names every provider HAL uses, as already in use: Google LLC (Gemini API) as HAL's language model, OpenAI for live spoken conversations, and xAI for voice messages and spoken replies. Anthropic, PBC is used for work agents and improvement requests, not for HAL. Apple Inc. (Apple Push Notification service) delivers notifications to the iPhone and iPad apps.