Skip to content

Security & Legal

Sub-processors

Last updated:

Template for legal counsel review — this document has not yet been reviewed by counsel and may not reflect final terms.

Blaze Technologies Inc ("Xelp") uses the following authorized sub-processors to deliver the Service, as listed in Annex 3 of our DPA.

Authorized sub-processors

| Sub-processor | Purpose | Location | | --- | --- | --- | | Cloudflare, Inc. | Frontend hosting, CDN, security (WAF/DDoS), AI infrastructure (Workers AI / AI Gateway) | United States (global network) | | Railway Corp. | Backend application hosting and data storage | United States | | Stripe, Inc. | Payment processing (customer billing data only; card details never touch Xelp) | United States | | Meta Platforms, Inc. / Meta Platforms Ireland Ltd | WhatsApp Cloud API, Instagram, Messenger, Facebook Login (message transmission) | United States / Ireland |

We may also use providers of infrastructure, analytics, email delivery, and customer support tooling that access personal data only to perform services for us and under data processing agreements (Privacy Policy, Section 8).

Channel platforms you connect

Channel platforms connected at the customer's direction (for example Telegram, TikTok, or SMS/email providers) act as independent services or separate controllers under their own terms, and are not Xelp sub-processors except to the extent they process data on Xelp's instructions.

Bring Your Own AI

If a business connects its own AI provider keys, that provider processes the business's AI traffic under the business's own agreement with the provider and is not a Xelp sub-processor. Xelp-managed AI features run on Cloudflare Workers AI / AI Gateway (listed above), and we do not permit our AI infrastructure providers to use customer or End User data to train their general-purpose models.

Notification of changes

We will notify customers (via the Service, email, or this page) of any intended addition or replacement of sub-processors at least 15 days in advance. Customers may object on reasonable data protection grounds as described in the DPA, Section 5.3.

A current list of sub-processors is available at any time on request to privacy@xelp.io.