Sub-processors.
Disclosed in full because hidden sub-processors are an audit finding.
Elyon SCI uses the third-party service providers listed below to deliver the Elyon platform. Customers and their privacy regulators require disclosure; we publish the canonical list and update it on every material change.
This list is canonical. It reflects providers that may process customer personal data or customer-tenant content in the course of delivering the service. The list is reviewed quarterly and on every material vendor change.
| Sub-processor | Service provided | Data processed | Location | Certifications |
|---|---|---|---|---|
| Anthropic | AI inference (Claude API — AEGIS) | Customer-tenant content submitted in AI requests | United States | SOC 2 Type II |
| Amazon Web Services (AWS) | Infrastructure, AWS Bedrock model hosting | Application and customer data (production region) | United States | SOC 1/2/3, ISO 27001, ISO 27017, ISO 27018, PCI DSS |
| Google Cloud (Firebase / Firestore) | Primary database, authentication, cloud functions | Customer tenant data, authentication records | United States | SOC 1/2/3, ISO 27001, ISO 27017, ISO 27018 |
| Netlify Will be retired once the full platform migrates to Cloudflare Workers (see Cloudflare row). | Static web hosting (app.elyonsci.ai) | Application static assets; no customer data at rest | United States | SOC 2 Type II |
| Cloudflare Planned consolidation target — Cloudflare will host the platform application in addition to the marketing site once platform migration completes. | DNS, edge security, and static web hosting via Workers (elyonsci.ai, www.elyonsci.ai) | DNS records, HTTP request metadata, marketing-site static assets | United States / Global | SOC 2 Type II, ISO 27001 |
| Mapbox | Geocoding, routing, map rendering | Origin/destination addresses; lane data | United States | SOC 2 Type II |
| Twilio | SMS notifications and inbound messaging | Phone numbers and message content for SMS workflows | United States | SOC 2 Type II, ISO 27001 |
| SendGrid (Twilio) | Transactional and outbound email | Email addresses and message content | United States | SOC 2 Type II, ISO 27001 |
| Bland.ai | Outbound and inbound voice AI for carrier check-calls | Phone numbers, call audio, transcripts | United States | SOC 2 (confirm current attestation) |
| EasyPost | Parcel rating, labels, and tracking | Shipment addresses, parcel dimensions, tracking numbers | United States | SOC 2 Type II |
| OpenAI | AI inference fallback (GPT models) | Customer-tenant content submitted in fallback AI requests | United States | SOC 2 Type II |
| GitHub (Microsoft) | Source control, CI/CD, Advanced Security | Source code, build logs (no customer production data) | United States | SOC 1/2, ISO 27001 |
| Smartlead | Outbound sales email infrastructure (marketing only) | Prospect contact data; no customer-tenant data | United States | Vendor attestations on file |
The following are engaged only for specific customer configurations. They process data only for tenants that have enabled the corresponding feature.
- SMC³ CarrierConnect XL
- LTL rating and transit data for customers using LTL workflows.
- ODFL API
- Direct carrier rating and tracking for customers configured to use Old Dominion Freight Line.
Elyon SCI will notify customers of additions or material changes to the sub-processor list with at least thirty (30) days' advance notice via in-app notification and email to the designated contact, except where an emergency change is required to preserve security or continuity of service. Customers retain the right to object to a new sub-processor under the terms of the Data Processing Addendum.
Enterprise customers can subscribe to sub-processor change notifications by emailing support@elyonsci.ai.