Legal
Subprocessors
Public list of nox.markets subprocessors: model providers, locations, transfer tools, 30-day change notice, and a dated changelog for security reviewers.
Last updated: 16 September 2026
Operator: NOX AETERNA GROUP LLC, a Wyoming limited liability company, trading as nox.markets, 5830 E 2nd St, Ste 7000 #34506, Casper, WY 82609, USA
Same table as /trust
Change notice: 30 days before a new subprocessor processes customer personal data, emailed to the workspace owner and posted here with a dated changelog.
Objection: DPA customers may object in writing within 15 days of notice. If we cannot accommodate, they may terminate the affected service before the add date; prepaid unused platform fees refunded pro-rata for that remainder.
Removal: Removals may be immediate; this changelog is still updated.
This page lists entities nox.markets uses, or will use, to process customer personal data. The last column says whether each one is in use: no product in this build calls a model yet, and checkout takes no payment yet.
Customer-facing systems we connect to (QuickBooks Online, Xero, HubSpot, Gmail, and similar) are the customer’s processors, not our subprocessors. We hold a token; they already have the data. They appear on product integrations[], not in the tables below.
No advertising network. No third-party marketing pixel on authenticated app routes.
Platform subprocessors
Entities used for all or most workspaces.
| Legal entity | Purpose | Data classes | Location of processing | Contract | In production at launch? |
|---|---|---|---|---|---|
| Hetzner Online GmbH | Server hosting, database, backups | account_data, workspace_config, connector_secrets, run_payload, run_metadata, audit_event, support_data, website inquiries | Germany (Nuremberg) | Data processing agreement — to conclude before launch | Yes |
| Zoho Corporation B.V. | Email hosting for our mailboxes | Email you send us and our replies, including support requests | EU (Zoho EU data centers) | Data processing addendum — to request before launch | Yes |
| Stripe, Inc. | Payments, invoices, tax on our fees | Billing identity, last-four, subscription state. No PAN on our side | US | Stripe DPA | No — checkout records a waitlist and takes no payment |
| OpenAI, LLC | Model inference | Prompt + retrieved context + completion for products that call a model | US | DPA + ZDR / no-training terms where offered | No — no product in this build calls a model |
| Anthropic, PBC | Model inference | Same as OpenAI, when routed | US | DPA + no-training / ZDR where offered | No — no product in this build calls a model |
| Google LLC (Google Cloud / Vertex AI) | Model inference | Same, when routed | US | Google Cloud DPA | No — no product in this build calls a model |
ZDR / no-training: we use those terms where the endpoint offers them. Abuse-monitoring exceptions in provider programs may still apply.
Conditional subprocessors
Used only when their trigger applies.
| Legal entity | Trigger | Data | Location |
|---|---|---|---|
| Slack Technologies, LLC | A Slack webhook is configured for new-inquiry alerts | Inquiry details: email, name, company, message | US |
| Google LLC | Sign in with Google is enabled | Name, email address, Google account id | US |
| Plaid Inc. | Customer connects a bank for a connected product that lists Plaid in integrations[] | Account/balance/transaction data the product reads | US |
Notice mechanics
- New entity that will process customer personal data: 30 days prior notice to
owner+ this page. - Objection window for DPA customers: 15 days from notice.
- If we cannot accommodate: terminate the affected service before the add date; unused prepaid platform fees for the remainder refunded pro-rata.
Changelog
Security reviewers compare snapshots. This page keeps at least 24 months of history.
| Date | Change |
|---|---|
| 2026-09-16 | List corrected to the actual launch setup. Hosting moves to Hetzner Online GmbH (Nuremberg, Germany) and Zoho Corporation B.V. is added for email. Amazon Web Services, Vercel, Cloudflare, WorkOS and Sentry are removed — none of them was in use. Stripe and the model providers are marked as not in use yet; Google (sign-in) is added as conditional. The EU-region offer (AWS eu-central-1) is withdrawn. |
| 2026-09-15 | Initial publication of launch platform subprocessors (AWS, Vercel, Cloudflare, Stripe, WorkOS, OpenAI, Anthropic, Google Cloud / Vertex AI, Sentry) and conditional subprocessors (Slack Technologies, LLC; Plaid Inc.). No removals. |
Older entries will appear above this line as they occur. If this table has only the initial row, that is the full public history to date — not a missing archive.