1. Active subprocessors
1.1 Hosting + data layer
| Provider | Service | Region | Data type |
|---|---|---|---|
| Supabase Inc. | Postgres + Storage + Auth | ap-southeast-1 (Singapore) | All customer data + reports |
| Railway Corp. | Compute hosting (FastAPI + Celery workers) | US-East (Virginia) — SG migration planned | Processing layer, no long-term storage |
| Vercel Inc. | Edge / static hosting + serverless functions | SG / HKG edge | Static assets + form submissions |
| Cloudflare Inc. | DNS + DDoS + WAF | Global anycast | DNS metadata only |
1.2 LLM-as-judge services (Quantify Moonshot adapter)
For LLM-as-judge evaluation within the Moonshot adapter, the following providers are available. Default is AWS Bedrock Claude (Singapore region) for MAS-licensed customers. Other providers are opt-in only with explicit click-through acknowledgement in the AgentSure portal.
| Provider | Default? | Region | Note |
|---|---|---|---|
| AWS Bedrock (Claude) | Yes (MAS-licensed) | ap-southeast-1 (Singapore) | Default judge model |
| DeepSeek | Opt-in only | CN mainland | Cost-sensitive Scan-tier scenarios; requires explicit click-through |
| OpenAI | Opt-in | US (primary) | Customer-configured |
| Anthropic | Opt-in | US (primary) | Customer-configured |
1.3 Operational + communications
| Provider | Service | Data type |
|---|---|---|
| Resend Inc. | Transactional email (onboarding, password resets, scan-ready notifications) | Recipient email + name |
| Sentry | Application error monitoring | Stack traces + request metadata |
| BetterStack | Uptime monitoring + log drain | Service health metrics + logs |
| PostHog Cloud (EU) | Product analytics | Pseudonymised event data, IP hashed |
| Stripe | Subscription billing + invoices (post-launch) | Payment method + billing address |
MAS Outsourcing Notice 658 customers: this list, plus our DPA Section 4 (Subprocessors), satisfies the "sub-outsourcing disclosure" obligation under §5.5 of the Notice. Material changes trigger 30-day notice + customer right to object.
2. How we choose subprocessors
Each subprocessor is selected against the following criteria, in order:
- Data-protection posture (SOC 2 or ISO 27001 preferred)
- Regional data residency support (Singapore for MAS customers)
- Contractual flow-down of GDPR / PDPA / MAS 658 obligations
- Operational reliability (uptime SLA, support response time)
- Pricing transparency (no surprise charges)
3. Notification of changes
We notify customers at least 30 days before adding or replacing a subprocessor by:
- Updating this page (with a dated changelog at the bottom)
- Emailing the registered billing contact
- Posting a status note on agentsure.tech/status (when material)
4. Subprocessor changelog
- 2026-05-13 — Initial publication.
5. Questions or concerns
If you have concerns about a specific subprocessor, contact legal@agentsure.tech. You may request a Sovereign Mode configuration (AWS Bedrock SG region only, no CN-hosted services) at +30% pricing on any tier.