Subprocessor List
Instrumento.io — Third-Party Subprocessors
Effective date: January 1, 2025 · Version 1.0.0
Template notice: This document is a template and must be reviewed by qualified legal counsel before publication. Verify that all subprocessors listed are actually in use and that transfer mechanisms are current. See
.docs/legal/README.md
Overview
Instrumento.io engages the following third-party subprocessors to deliver the Service. All subprocessors are bound by data processing agreements that impose data protection obligations equivalent to those in our DPA.
We will provide at least 30 days' advance notice of any addition or replacement of a subprocessor by updating this page and notifying organization owners via email and in-app banner.
Infrastructure and Storage
| Subprocessor | Purpose | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|
| Amazon Web Services (AWS) | Cloud infrastructure, object storage (S3), database hosting | All customer data | United States (us-east-1) | SCCs (EU–US) / IDTA (UK) |
Payment Processing
| Subprocessor | Purpose | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|
| Stripe, Inc. | Payment processing, subscription management | Billing name, email, payment card metadata (last 4 digits), billing address | United States | SCCs (EU–US) / IDTA (UK) |
Authentication and Identity
| Subprocessor | Purpose | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|
| Google LLC | OAuth 2.0 sign-in (optional), Google Sheets integration | Name, email address, profile photo (if Google sign-in used) | United States | SCCs (EU–US) / Adequacy decision (UK) |
Email and Communications
| Subprocessor | Purpose | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|
| Resend, Inc. | Transactional email delivery (account notifications, password resets, DSR notifications, subprocessor change alerts) | Email address, name, email content | United States | SCCs (EU–US) |
Artificial Intelligence
| Subprocessor | Purpose | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|
| Manus AI (Built-in Forge API) | AI-powered features: impact analysis, form generation, AI analyst, report drafting | Program data and queries submitted to AI features | United States | SCCs (EU–US) |
Note: AI features process only the data you explicitly submit to them. We do not use your program data to train AI models without your explicit consent. You may disable AI features in your organization settings.
Error Monitoring and Observability
| Subprocessor | Purpose | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|
| Sentry (Functional Software, Inc.) | Error tracking, performance monitoring | Error messages, stack traces, user identifiers (anonymized where possible), browser/OS metadata | United States | SCCs (EU–US) |
Analytics
| Subprocessor | Purpose | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|
| Manus Analytics | Aggregated usage analytics (page views, feature usage) | Anonymized usage events, IP address (hashed) | United States | SCCs (EU–US) |
Change History
| Date | Change | Version |
|---|---|---|
| 2025-01-01 | Initial subprocessor list published | 1.0.0 |
Objections
Customers may object to a new or replacement subprocessor within 30 days of notification. To object, email [email protected] with the subject line "Subprocessor Objection — [Subprocessor Name]". We will work with you to find a resolution. If we cannot accommodate your objection, you may terminate your subscription without penalty.
Contact
Instrumento.io Email: [email protected] Website: instrumento.io/legal/subprocessors