Annex C — Subprocessors and Infrastructure Disclosure

1. Subprocessors (depending on deployment)

Infere may use subprocessors to provide the Service. The following may process personal data depending on configuration:

• Cloudflare (edge routing; Workers; KV; Durable Objects)
• AWS (e.g., Cognito; S3; SES/SNS; SageMaker prompt security, where enabled)
• Stripe (payment processing)
• AI Providers listed in Annex B or the Service

2. Self-hosted vs managed components

Where infrastructure components are operated by Infere, they are not deemed as subprocessors. Where operated by a third-party managed provider, the provider will be a subprocessor.

Every AWS component is hosted in region us-east-1 (N. Virginia, USA).

3. Updates

Infere may update subprocessors and will provide notice as required by the DPA, whereas User may object to a new subprocessor on reasonable data protection grounds within the notice period. If the parties cannot resolve the objection, User may terminate the affected Service.

4. Protection standards

Infere shall ensure that each subprocessor is bound by written contractual obligations providing data protection standards no less protective than those set out in this DPA, in accordance with the GDPR.

5. Geographic transparency

Infere shall make available information on the primary hosting regions of subprocessors upon request or via documentation.