Purpose
This page identifies third-party service providers that may process personal information or customer data for Mitoma Systems. A customer order form, DPA, or security schedule may add, restrict, or replace this list for a particular deployment.
The location column identifies the provider entity or the countries in which processing is currently likely. Customer-specific residency and transfer commitments are recorded in the applicable agreement.
Current marketing site
The public marketing site is a static Astro site hosted on Vercel. It is deliberately kept separate from the product environment and does not hold product customer or mission data.
The contact form submits to our Vercel serverless function in Sydney and sends the message to us through Microsoft 365. The site also uses Vercel Web Analytics and Speed Insights for cookieless, aggregated usage and performance measurement. It does not currently embed chat, scheduling, newsletter, checkout, advertising, or retargeting code.
| Provider | Purpose and information | Likely location |
|---|---|---|
| Vercel, Inc. | Website hosting, content delivery, security logs, the Sydney contact-form function, Web Analytics, and Speed Insights. It may process request metadata and IP addresses for delivery and security, contact submissions briefly in transit, and aggregated or anonymous page and performance measurements. | Provider entity in the United States; contact-form function configured in Sydney, Australia; site delivery uses Vercel's global edge network. |
| Microsoft 365 | Business email, including delivery and storage of contact-form messages, direct email, and associated message metadata. | Australia, with Microsoft supporting services and operations that may involve the United States. |
Production service providers
The providers below are built into available production-service paths and may process data only when the relevant path is enabled. Listing a provider does not mean it receives every customer's data. The confirmed deployment-specific provider set, status, region, model route, and controls are attached to the applicable DPA, order form, or security schedule before regulated or customer-confidential data is processed.
| Provider | Purpose and information | When used | Likely location |
|---|---|---|---|
| Microsoft Azure | Cloud hosting, identity, storage, database, logging, security, and infrastructure, with backup processing where configured. It may process account information, customer content, evidence metadata, usage records, and technical logs. | Only for a deployment that selects the applicable Azure services. | The customer-selected and documented Azure geography, currently expected to be Australia, the United States, the United Kingdom, or a country within the European Economic Area. |
| Microsoft Azure OpenAI Service | Model processing for enabled AI-assisted interpretation and review. It may process the prompts, relevant customer content, and generated output needed for the requested function. | Only where AI functionality is enabled for the deployment. | The approved Azure deployment geography, currently expected to be Australia, the United States, the United Kingdom, or a country within the European Economic Area. |
| Amazon Web Services, including Amazon Bedrock | Cloud infrastructure and, where selected, model processing for AI-assisted interpretation and review. It may process account information, customer content, prompts, generated output, evidence metadata, usage records, and technical logs needed for the enabled services. | Only for a deployment that selects AWS infrastructure or an approved Amazon Bedrock model route. | The customer-selected and documented AWS region or geography. This may include Australia, the United States, the United Kingdom, or a country within the European Economic Area; cross-region inference or another processing location applies only where approved for the deployment. |
| Postmark | Transactional email delivery for account verification, password reset, invitations, service notices, and security alerts. It may process recipient and sender details, message content, delivery events, IP addresses, and message metadata. | Only where Postmark is configured as the service email transport. | United States; Postmark and its infrastructure subprocessors may process data in the United States. |
| Stripe | Payment processing, invoicing, tax-related billing functions where enabled, and subscription administration. It may process billing contacts, customer and subscription identifiers, purchases, credits, refunds, payment status, tax information, and payment details submitted directly to Stripe. | Only where live checkout, billing, or a customer agreement uses Stripe. | Australia and the United States; Stripe group processing may also involve Ireland for European services and other locations identified in Stripe's applicable terms and subprocessor disclosures. |
Other third parties
LinkedIn is not our subprocessor merely because we link to it. If you choose to follow an outbound LinkedIn link, LinkedIn independently processes the information it receives under its own privacy terms.
A customer may also direct Mitoma Systems to connect to a customer-controlled model endpoint, CAD, simulation, PLM, engineering, support, or other tool. Those providers, processing locations, information flows, and roles must be identified in the customer's deployment documentation before customer content is sent. A provider acting directly on the customer's instructions or under the customer's account is not necessarily our Subprocessor.
Restricted deployments
For allied, defence, export-controlled, sovereign, or regulated programs, do not submit restricted data until the approved provider set, residency, support model, access controls, and processing instructions are captured in signed terms.
Changes
We may update subprocessors as the service changes. For customers with an incorporated DPA, advance notice, objection rights, urgent-change treatment, or prior-approval rights are governed by that DPA and any deployment-specific schedule.
Contact
Questions about subprocessors can be sent to our Privacy Officer at info@mitoma.systems.