Version: 2026.2 ยท Effective Date: 21 AUGUST 2026
This list forms Schedule A of the Exenai Privacy & Data Policy. Changes are notified under Section A5.4 of the Data Processing Addendum and may be objected to under Section A5.5.
1. Sub-processors in the service data path
These providers process Customer Data as part of delivering the Services. Exenai acts as processor and these are its sub-processors.
Hetzner Online GmbH
Cloud hosting for the Exenai Platform and Automation as a Service, including the Toca platform operated by Exenai.
Processing location: Germany (EU) for EU and UK customers. United States for US customers.
Microsoft (Azure)
Cloud services underpinning Exenai Connect, the Connect App Host and the Candidate Experience Platform, and hosting the Exenai-operated Identity Server.
Processing location: United Kingdom and Netherlands for EU and UK customers. United States data centres for US customers where required.
Tocalabs Limited
Licensor of the Toca platform used within Automation as a Service. Technical support access to Exenai-operated production environments, which may include access to Customer Data.
Processing location: United Kingdom.
Twilio Inc. (including Twilio SendGrid)
Outbound email and messaging, including service notifications and one-time passcodes.
Processing location: United States.
OpenAI
Large language model API for Exenai AI Features.
Processing location: United States.
Google LLC (Gemini API)
Large language model API for Exenai AI Features.
Processing location: United States, EU.
Anthropic (Claude)
Large language model API for Exenai AI Features, and the AI Client used by Exenai through Exenai Connect to build, configure, support and troubleshoot customer applications, dashboards, reports and automations.
Processing location: United States.
Data residency. Customer environments are provisioned in the region matching the customer. Data belonging to EU and UK customers is hosted in the EU and the UK, on Hetzner in Germany and on Azure in the United Kingdom and Netherlands. Data belonging to US customers is hosted in the United States, on Hetzner and Azure US infrastructure. A customer's environment is not moved between regions without agreement. Model Provider processing is the exception to the above and is described below.
Model Providers. OpenAI, Google and Anthropic are drawn from a pool. Exenai selects, combines and may change the provider used for any given feature at its discretion, and does not publish a per-feature mapping. Customer data processed by Model Providers is not used to train any public model; processing is limited to instance-based API processing to deliver the relevant feature.
2. Business tools
These are tools Exenai uses to run its own business. Customer Data does not flow through them as part of delivering the Services, but customer personal data may be held in them incidentally, for example where it appears in correspondence or in notes of a meeting. They are listed for transparency.
Google Workspace
Primary business email, calendar and document productivity.
Processing location: United States, EU.
Microsoft 365
Secondary productivity suite, including SharePoint and OneDrive for document storage. Used occasionally.
Processing location: EU, United Kingdom.
HubSpot, Inc.
Customer relationship management, marketing, website visitor tracking and support ticketing.
Processing location: United States.
ClickUp
Project management, collaboration and meeting notes.
Processing location: United States.
Xero
Accounting and financial records, including customer billing contacts and invoicing.
Processing location: New Zealand, EU.
Plausible Insights OÜ
Website traffic analysis. Cookieless. Does not store raw IP addresses or generate persistent identifiers.
Processing location: Estonia (EU), data hosted in the EU.
Google LLC (Analytics)
Website traffic analysis.
Processing location: United States.
Wix.com Ltd.
Website hosting, built-in website analytics and cookie management.
Processing location: EU, United States.
3. Authentication
Sign-in to Exenai Connect surfaces and Community User portals is handled by Identity Server, which Exenai operates itself within its Azure environment. It is not a third-party service and is not a sub-processor.
Users may sign in with a Microsoft, Google or LinkedIn identity, or with a one-time passcode. Where a user signs in with an existing identity, they authenticate directly with that provider using their own credentials and Exenai receives only the resulting assertion. Those identity providers are not Exenai sub-processors. One-time passcodes are delivered by Twilio SendGrid, listed in Section 1.
4. AI Clients
There are two distinct cases, and they are treated differently.
The customer's own AI Client. Where a customer connects its own Claude, ChatGPT or Microsoft Copilot subscription through Exenai Connect, that AI Client is the customer's tool and is not an Exenai sub-processor. Exenai's processing is limited to the gateway: transporting the request, applying the customer's configured policy controls, and recording the audit log. Processing by that provider is governed by the customer's own agreement with it.
An AI Client operated by Exenai. Exenai also connects its own AI Client, currently Anthropic's Claude, through Exenai Connect in order to build, configure, support and troubleshoot applications, dashboards, reports and automations for customers. Most of this work is done by customers themselves using their own AI Client; Exenai does it on request. In that case Exenai is directing the processing and the AI Client provider is an Exenai sub-processor, listed in Section 1.
Because Exenai Connect provides a live view of connected systems, this work is carried out against live customer data rather than a copy. It is confined to what is necessary for the task, subject to the customer's configured permissions and policy controls, and recorded in the customer's audit log in the same way as any other request through the gateway. Exenai maintains its AI Client subscriptions with model training disabled.
5. Changes to this list
Exenai will give at least 30 days' notice before adding or replacing a sub-processor in Section 1, by updating this page and notifying the customer's registered contact. Customers may object on reasonable data protection grounds as set out in Section A5.5 of the Data Processing Addendum.
Questions about this list can be sent to privacy@exenai.com.
Change log
2026.2. Twilio SendGrid, Tocalabs Limited, Plausible, Microsoft 365 and Xero added; all were engaged but not previously listed. List separated into service data path and business tools. Anthropic purpose widened to cover Exenai's own use of Claude through Exenai Connect for customer development and support work. Azure purpose updated to reflect Exenai Connect and the Connect App Host. Data residency by customer region documented, covering Hetzner and Azure in both EU/UK and US. HubSpot and Wix purposes widened to reflect website tracking and analytics. Authentication section added. AI Client section rewritten to distinguish a customer's own AI Client from one operated by Exenai. Change notice and objection mechanism added.