Legal
Authorized Subprocessor List
This document lists the subprocessors authorized by 37Arc, Inc. (“37Arc”) to process Personal Data on behalf of Customers pursuant to the Data Processing Exhibit (“DPA”) and applicable data protection laws.
Last updated July 15, 2026 · Version 1.0
Subprocessor Notification Subscription
Get advance notice of subprocessor changes
Subscribe to receive notice before a new subprocessor begins processing Customer Data, as described in DPA Section 4.4(c). Notifications are operational and legal notices only — not marketing — and you can unsubscribe at any time.
About this list
Purpose. This list is provided to fulfill 37Arc’s obligations under DPA Section 4.4(c) and Annex 3, and to enable Customers to assess our data processing arrangements.
Updates. 37Arc may update this list as subprocessors are added or removed. Customers subscribed to notifications will receive advance notice as specified in the DPA. The current version is always published at https://www.37arc.com/subprocessors and available upon request to privacy@37arc.com.
Notification. To receive advance notice of subprocessor changes, subscribe above, or contact privacy@37arc.com with the subject line “Subprocessor Notification Subscription.”
Authorized subprocessors
Cloud Infrastructure
| Subprocessor Name | Service/Function | Location(s) | Data Processed |
|---|---|---|---|
| Google LLC (Google Cloud Platform) | Cloud hosting, storage, compute, database services | US (primary), with regional options available | Customer Data, application data, usage logs |
AI/ML Providers
These providers are used for AI inference only. They do not train, fine-tune, or develop models on Customer Data. 37Arc uses enterprise/API tiers configured to exclude inputs and outputs from provider model training.
| Subprocessor Name | Service/Function | Location(s) | Data Processed |
|---|---|---|---|
| Anthropic PBC | AI model inference only (no training on Customer Data) | US | Prompts, content for AI processing (subject to Customer controls and “No Training” elections) |
| OpenAI, LLC | AI model inference only (no training on Customer Data) | US | Prompts, content for AI processing (subject to Customer controls and “No Training” elections) |
Monitoring & Debugging
| Subprocessor Name | Service/Function | Location(s) | Data Processed |
|---|---|---|---|
| Functional Software, Inc. (Sentry) | Error tracking, application monitoring, performance telemetry | US | Application errors, stack traces, performance metrics, limited contextual data for debugging |
Categories of processing
The subprocessors listed above may process Customer Data in the following ways, depending on the Services:
- Hosting and Storage: Storing Customer Data in secure cloud infrastructure
- Processing and Computation: Running applications, queries, and AI/ML inference workloads
- Monitoring: Error tracking, performance monitoring, and debugging telemetry
Data protection measures
Contractual protections. 37Arc maintains written agreements with each subprocessor that include:
- Data protection obligations at least as protective as those in the DPA
- Confidentiality requirements
- Security measures appropriate to the nature of processing
- Use limitations (processing only for specified purposes)
- Data deletion or return upon termination
International transfers. Where subprocessors are located outside the EEA, the UK, or Switzerland, 37Arc ensures appropriate transfer mechanisms are in place, such as:
- Standard Contractual Clauses (SCCs)
- EU-US Data Privacy Framework certification (where applicable)
- Other legally recognized transfer mechanisms
Assessment. 37Arc conducts due diligence on subprocessors prior to engagement and periodically reviews their data protection practices.
Customer objection rights
As described in the DPA, Customers may object to a new subprocessor by providing written notice within the timeframe specified in the DPA (typically 15–30 days from notification).
If 37Arc is unable to address Customer’s reasonable objection and cannot provide the Services without using the subprocessor, Customer may terminate the affected Services as described in the DPA.
Contact
For questions about this subprocessor list or to request additional information:
- Email: privacy@37arc.com
- Subject: “Subprocessor Inquiry”
Revision history
| Version | Date | Changes |
|---|---|---|
| 1.0 | July 15, 2026 | Initial publication |