Subprocessors

How we choose and manage subprocessors

A subprocessor is a third party that processes customer personal data on our behalf. Before engaging one, Nandini Rao's security and compliance team reviews its security attestations (such as SOC 2 or ISO/IEC 27001), its data location, and its contract terms. Each subprocessor signs a data processing agreement with obligations at least as protective as our Data Processing Addendum at /legal/dpa.

We keep the list short on purpose. Customer invoices, evidence files and dispute packets are stored only in our AWS environment; the other providers below receive the narrower data each needs to perform its function.

Hosting and core infrastructure

These providers run the platform itself and process customer content.

• Amazon Web Services, Inc. (United States): cloud hosting for application servers, databases, object storage, backups and key management. Primary region us-east-1 (N. Virginia), failover region us-west-2 (Oregon).
• Cloudflare, Inc. (United States, global edge network): DNS, content delivery, TLS termination, web application firewall and DDoS protection for atahskia.si and the application. Request traffic passes through Cloudflare's edge; customer content is not stored there.

Monitoring and reliability

These providers help us detect outages, errors and security events. We configure log pipelines to exclude invoice contents and scrub personal data fields before transmission where possible.

• Datadog, Inc. (United States, US1 site): infrastructure metrics, application performance monitoring, log management and security alerting.
• Functional Software, Inc. d/b/a Sentry (United States): application error tracking and diagnostics, with request bodies and form fields scrubbed by default.

Communications

These providers deliver email from ATAHSKIA to customers and from the platform on a customer's instruction.

• Postmark, operated by ActiveCampaign, LLC (United States): transactional email, including dispute deadline alerts, § 541.8 resolution reminders, password resets and, where a customer configures it, dispute packets sent to billing party contacts.
• Google LLC, Google Workspace (United States): corporate email, calendar and documents used by ATAHSKIA staff when corresponding with customers and handling support requests.

Billing

Payment card details are entered directly into Stripe's hosted fields and never touch ATAHSKIA servers.

• Stripe, Inc. (United States): subscription billing, invoicing, payment processing and tax calculation for platform fees and success fees. Stripe receives billing contact names, email addresses, company details and payment data, not invoices or trade data.

ATAHSKIA affiliates and personnel

ATAHSKIA engineering, support and recovery staff based at our Hyderabad headquarters access customer content to operate the service, investigate issues and support dispute work. Access is granted through SAML SSO with MFA, limited by role, time-bound for production systems, and recorded in audit logs reviewed by the security team.

Customer-directed integrations

When a customer connects a transportation management system, visibility platform, terminal portal or ERP from /product/integrations (for example CargoWise, project44, eModal or SAP S/4HANA), data flows between that service and ATAHSKIA under the customer's own contract with the vendor. Those vendors act for the customer, not for ATAHSKIA, and are not our subprocessors.

Change notifications

We give at least 30 days' notice before a new subprocessor begins processing customer personal data. Notice is given by updating this page and emailing customers who subscribe to subprocessor notifications. To subscribe, email privacy@atahskia.si with the subject "Subprocessor notifications".

Customers may object to a new subprocessor on reasonable data protection grounds within the notice period, as described in section 6 of the DPA. Questions about this list go to privacy@atahskia.si or security@atahskia.si.