XAVVI HOLDINGS — Subprocessors
Last updated: October 2, 2025
This page lists the third-party subprocessors that XAVVI HOLDINGS (“Xavvi”) engages to help deliver our Services (hosting, storage/CDN, monitoring, email delivery, AI processing, and related functions). Capitalized terms have the meanings in our Privacy Policy and Data Processing Addendum (DPA).
Current subprocessors
| Vendor | Purpose | Categories of Personal Data | Primary Processing Location(s) | Transfer Mechanism | Typical Retention | Notes |
|---|---|---|---|---|---|---|
| Amazon Web Services, Inc. (AWS) | Cloud infrastructure (compute, database, storage/CDN) | Platform Data (including media you upload), account/workspace metadata, tokens/secrets (encrypted), logs | United States (with global edge delivery as configured) | Not applicable (US processing). If cross-border, SCCs as applicable | Per Privacy Policy retention schedule; backups ≤ 35 days | Includes services such as EC2, RDS, S3/CloudFront as configured |
| Cloudflare, Inc. | CDN, DDoS protection, WAF, edge routing | Network telemetry (request metadata, IP), limited log data | Global | SCCs where applicable for transfers from EEA/UK | Short-lived edge logs; security logs per policy | Used for performance and security |
| Email delivery provider (e.g., Amazon SES or equivalent) | Transactional email (account notices, verification, receipts) | Business contact info (names, emails), message metadata | United States (or as configured) | SCCs where applicable | Message logs per provider defaults; content minimal | Designated provider will be reflected in headers |
| AI model/processing provider(s) | LLM / vision / audio-video processing to provide AI features you invoke | Inputs and outputs you submit for processing; no training/advertising use permitted by contract | United States / EU (varies by provider) | SCCs/IDTA where applicable | Transient processing; minimal logs | Activated only for AI features you choose to use |
Optional/feature-dependent providers. Depending on your configuration, we may enable analytics or error monitoring (e.g., Sentry, Datadog) or privacy-friendly site analytics (e.g., Plausible). These are disabled by default and, if enabled, will be added to this page before activation.
Change management
We will provide notice of new or replacement subprocessors at least 30 days before they process Personal Data, by updating this page and/or notifying workspace administrators. Under the DPA, you may object on reasonable grounds relating to data protection by emailing privacy@xavvi.com within that period. If we cannot reasonably accommodate your objection, you may suspend the affected feature or terminate the applicable Services as set out in the DPA.
Contact
Questions about this list? Email privacy@xavvi.com.