Subprocessors

Overview

Apivom Technology FZ-LLC engages a limited number of third-party Subprocessors to deliver the APIVOM Customer Success Platform and the Apivom MCP service. This page is the authoritative list and is updated whenever a Subprocessor is added or removed. Customers may subscribe to change notifications by emailing privacy@apivom.com.

Definition

A Subprocessor is a third party engaged by Apivom that processes Personal Data on behalf of the customer ("Controller"). Apivom does not engage Subprocessors for marketing, advertising, or profiling.

Self-Hosted Components (Not Subprocessors)

The following platform components are operated directly by Apivom on infrastructure that Apivom controls, and are therefore not Subprocessors:

• Atlas — API gateway (Fastify, self-hosted)
• Iris — Customer Success Management (Next.js, self-hosted)
• Vesta — Headless CMS (Strapi, self-hosted)
• Mars — Marketing automation (Mautic, self-hosted)
• Orbit / Omni — Customer Data Platform (RudderStack, self-hosted)
• Opus — Web analytics (Matomo, self-hosted)
• Key — Identity & Access Management (Keycloak, self-hosted)
• Mask — Authorization service (OpenFGA, self-hosted)
• Blob — Object storage (MinIO, self-hosted)
• Atom — Job queues (BullMQ + Redis, self-hosted)
• Odin — Error tracking (Sentry, self-hosted)
• Staff — Workflow automation (n8n, self-hosted)
• PostgreSQL & Redis — Databases self-hosted on Apivom-controlled virtual machines

Active Subprocessors

Subprocessor	Role	Processing location	Service area
Microsoft Corporation — Azure Compute & Storage	Infrastructure-as-a-Service (virtual machines, managed disks, networking) hosting all Apivom services	United States — East US 2 region	All platform services
Microsoft Corporation — Azure Front Door	Global CDN, WAF, and TLS termination at the edge	Microsoft global edge network	Public web traffic, MCP endpoint
Microsoft Corporation — Azure Key Vault	Cryptographic key storage and certificate lifecycle (Front Door auto-unseal, TLS certificates)	United States — East US 2 region	Platform-wide cryptographic operations
Microsoft Corporation — Azure AI Foundry	Foundation-model hosting for Claude 4.5 Sonnet inference exposed through the Abu agent service	United States — East US 2 region	AI agent inference (when enabled by customer)

All Microsoft sub-processing is governed by the Microsoft Online Services Data Protection Addendum and Microsoft's published EU Standard Contractual Clauses, which Apivom inherits and passes through to its customers.

International Data Transfers

Personal Data processed in Azure East US 2 leaves the European Economic Area. The transfer is covered by the EU Standard Contractual Clauses (Commission Decision 2021/914) — Module Three (Processor-to-Processor) — that Apivom holds with Microsoft. The corresponding UK International Data Transfer Addendum applies to UK-origin data.

Change Notifications

Apivom will provide at least thirty (30) days' advance notice by updating this page before any new Subprocessor begins processing customer Personal Data. To receive notifications by email, write to privacy@apivom.com.

Contact

Apivom Technology FZ-LLC

DMC-BLD-VD-G00-706, Building 5, Dubai Media City, Al Sofouh Second, Dubai, UAE

Privacy: privacy@apivom.com

General: info@apivom.com