Privacy and data processing

Service providers and subprocessors

Current schedule verified September 19, 2026

This schedule identifies third-party services that process TruLexa customer information for the product or for limited account, service-communication, billing, or payment functions. Services that do not process TruLexa customer information are excluded.

AIstrova remains responsible for personal information processed on its behalf. Providers may process information only for their stated service functions under written contracts or equivalent privacy and security terms.

Provider	Classification	Role and service	Location or configuration	Customer information involved
Amazon Web Services (AWS)	Core	Cloud and application hosting, logging and security monitoring, and AI-service infrastructure where used.	AWS Canada (Central) Region / Montréal configuration for core product infrastructure.	Account data, operational and security metadata, and transient product data as the requested workflow requires.
Google — Gemini Enterprise Agent Platform	Core	AI-model processing for configured TruLexa workflows.	Montréal configuration for Gemini Enterprise Agent Platform processing where used.	Transient prompts, selected context, documents, uploads, and generated workflow outputs as needed for the requested workflow.
Supabase	Core	Authentication and identity infrastructure.	Canada Central configuration.	Account and profile information, authentication metadata, and identity-related operational data.
Microsoft Graph API	Ancillary	Transactional email and service communications.	Processing follows the applicable Microsoft service configuration and terms.	Limited account, contact, and service-communication information. It is not used for confidential matter-content processing.
Stripe	Ancillary	Billing and payment communications and payment processing.	Processing follows the applicable Stripe service configuration and terms.	Billing contact information, payment metadata, and transaction information. It is not used for confidential matter-content processing.

Amazon Web Services (AWS)

Core

Role and service: Cloud and application hosting, logging and security monitoring, and AI-service infrastructure where used.
Location or configuration: AWS Canada (Central) Region / Montréal configuration for core product infrastructure.
Customer information involved: Account data, operational and security metadata, and transient product data as the requested workflow requires.

Google — Gemini Enterprise Agent Platform

Core

Role and service: AI-model processing for configured TruLexa workflows.
Location or configuration: Montréal configuration for Gemini Enterprise Agent Platform processing where used.
Customer information involved: Transient prompts, selected context, documents, uploads, and generated workflow outputs as needed for the requested workflow.

Supabase

Core

Role and service: Authentication and identity infrastructure.
Location or configuration: Canada Central configuration.
Customer information involved: Account and profile information, authentication metadata, and identity-related operational data.

Microsoft Graph API

Ancillary

Role and service: Transactional email and service communications.
Location or configuration: Processing follows the applicable Microsoft service configuration and terms.
Customer information involved: Limited account, contact, and service-communication information. It is not used for confidential matter-content processing.

Stripe

Ancillary

Role and service: Billing and payment communications and payment processing.
Location or configuration: Processing follows the applicable Stripe service configuration and terms.
Customer information involved: Billing contact information, payment metadata, and transaction information. It is not used for confidential matter-content processing.

Processing boundaries

Core providers may handle transient product data required to perform the TruLexa workflow selected by the user.
Ancillary providers are limited to account, service-communication, billing, or payment functions and are not used for confidential matter-content processing.
TruLexa does not authorize providers to use client submissions for AI-model training, advertising, resale, or unrelated independent purposes.

Provider changes

AIstrova maintains this schedule and updates it when its current providers change. Material changes affecting customer information are addressed through applicable contracting, onboarding, and privacy-notice processes.

For questions about this schedule, data-processing terms, or privacy and security review, contact privacy@aistrova.com.

Read the TruLexa Privacy Policy