Subprocessors
Third-party service providers that may process Customer Personal Data on behalf of Cadlyx.
Effective:
This page lists the subprocessors Cadlyx engages to provide the Service. We notify account administrators by email at least 30 days before any addition, removal, or change in the way a subprocessor handles Customer Personal Data. Customers that have signed a Data Processing Addendum may object as described in the DPA Section 6.
Infrastructure
| Subprocessor | Purpose | Region | DPA / Terms |
|---|---|---|---|
| Amazon Web Services, Inc. (AWS) | Cloud infrastructure, application hosting, data storage, database, queue | US — us-east-2 (current Standard service) | Link ↗ |
| Amazon Web Services, Inc. (AWS Bedrock) | Foundation model inference for Bid Advisor, CAD analysis, and quote generation. Operated under AWS Service Terms §50: contractual no-training on Customer prompts and outputs, no data sharing with foundation model providers, and no transmission outside the pinned region. AWS operates its own copies of model weights; model providers (including Anthropic) do not see Bedrock traffic. | US — us-east-2 (current Standard service) | Link ↗ |
Platform services
| Subprocessor | Purpose | Region | DPA / Terms |
|---|---|---|---|
| Clerk, Inc. | Authentication, identity management, multi-factor auth | United States | Link ↗ |
| Stripe, Inc. | Payment processing, subscription billing | United States | Link ↗ |
| Resend (resend.com) | Transactional email delivery (account, billing, RFQ, share notifications) | United States | Link ↗ |
| Hookdeck Technologies, Inc. | Webhook delivery and inbound webhook routing | Canada / United States | Link ↗ |
| Pusher Ltd. | Real-time event delivery (workspace presence, agent progress) | United States / European Union | Link ↗ |
Analytics & product
| Subprocessor | Purpose | Region | DPA / Terms |
|---|---|---|---|
| PostHog Inc. | Product analytics and error tracking (only when consent granted) | United States / European Union | Link ↗ |
Notes
- The current Standard service is commercial cloud for unrestricted work. We are building Cadlyx Secure on AWS GovCloud (US) to support manufacturers with CUI and export-control obligations. It is not part of the current Service unless Cadlyx confirms an authorized environment for the Customer in writing.
- PostHog is only loaded if the user has accepted analytics cookies via the cookie banner. With consent withheld, no event data is sent to PostHog.
- AWS Bedrock is the only foundation model inference layer used by Cadlyx. Customer Content (including CAD files and design data) is not transmitted to any third-party AI model provider directly. Cadlyx does not use Customer Content to train, fine-tune, or improve any AI/ML model. See Terms of Service §1.6 for the contractual training restriction.
- For the canonical machine-readable list (used by our DPA attachments), see cadlyx/legal/SUBPROCESSORS.md.
Questions: [email protected].