Legal
Sub-processors
Last updated · 2026-05-16
This page lists the sub-processors qlows engages to provide the Service. We update it when changes occur. Pro and Enterprise customers are notified by email at least 14 days before a material addition takes effect.
Each row shows the legal entity, the category of processing, the purpose, the region where data is hosted or accessed, and the international-transfer mechanism we rely on for any cross-border flow.
| Vendor | Category | Purpose | Region | Transfer mechanism |
|---|---|---|---|---|
| Anthropic, PBC | AI inference | LLM inference for requirement extraction, compliance flagging, drafting. No-training endpoints only. | United States | EU-US DPF + SCCs |
| OpenAI, OpCo LLC | AI inference (optional) | LLM inference when a customer chooses OpenAI as their handoff target. No-training endpoints only. | United States | EU-US DPF + SCCs |
| Vercel, Inc. | Hosting + CDN | Static and edge hosting for the qlows web app and marketing site. | US + EU regions | EU-US DPF + SCCs |
| Stripe Payments Europe Ltd. / Stripe, Inc. | Payment processing | Subscription billing, invoicing, customer portal, tax calculation. | Ireland (EU) / United States | EU-US DPF + SCCs |
| Google LLC | Analytics + Tag Management | Google Analytics 4 (aggregated traffic) and Google Tag Manager container. Only loaded after Analytics opt-in. | United States with EU regional collection | EU-US DPF + SCCs |
| Microsoft Corporation | Behavioral analytics | Microsoft Clarity heatmaps and session recordings. PII masked by default. Only loaded after Analytics opt-in. | United States | EU-US DPF + SCCs |
| Resend, Inc. | Transactional email | Magic-link delivery for Q-Routing, account notifications, renewal notices. | United States | EU-US DPF + SCCs |
Notice subscription
To receive 14-day advance notice of material sub-processor changes, email legal@qlows.comwith subject “Sub-processor notice” and the email you’d like added.
Transfer mechanisms
For data transferred outside the EEA / UK, qlows relies on one or more of: (a) adequacy decisions where they apply, (b) the EU-US Data Privacy Framework where the sub-processor is certified, and (c) Standard Contractual Clauses (SCCs) per Commission Decision 2021/914 with appropriate supplementary measures.
Right to object
DPA-signed customers may object to a new sub-processor on reasonable data-protection grounds within the 14-day notice window. We will work in good faith to provide an alternative or, failing that, allow you to terminate the affected Service portion without penalty for the remainder of the paid term.