Trust Center
Subprocessors
The providers we plan to use for Client OS, Talent OS, payments and e-signature. None processes client data through our platform yet; any change comes with 30 days' notice.
In short
Remote Pro Ai publishes the providers it plans to use to run Client OS, Talent OS, payments and e-signature, and gives clients 30 days’ notice before adding or replacing one. None processes client data through our platform yet: each entry shows its purpose, data and region, and changes from Planned to In use when its DPA is signed.
Planned subprocessors
| Subprocessor | Purpose | Data | Region | Status |
|---|---|---|---|---|
| Vercel | Hosting of the website and the Client OS, Talent OS and Trust Center front ends | Account and usage data | Planned: Riyadh, Frankfurt, Virginia | Planned |
| Cloudflare | CDN, DNS and web application firewall | IP addresses, request metadata | Global, with KSA and UAE regional services | Planned |
| Amazon Web Services | Databases and application back ends | All platform data | Planned: Riyadh, Frankfurt, Virginia | Planned |
| HubSpot | CRM, forms, meetings and marketing email | Contact details, messages, meeting bookings | EU | Planned |
| Stripe | Card payments and tax calculation (UAE, EU, UK, US) | Billing contacts, payment details | EU, US | Planned |
| Moyasar | Payments in KSA (mada, Apple Pay, STC Pay) | Billing contacts, payment details | KSA | Planned |
| Zoho Sign with emdha | Electronic signatures (Nafath-backed in KSA) | Signer names, emails, documents | KSA, EU | Planned |
| Wathq | Saudi company verification (KYB) | Company registry data | KSA | Planned |
| Sumsub | Identity verification and sanctions screening | Signatory and founder identity data | EU | Planned |
| Certn | Engineer background checks | Engineer identity documents | UK, Canada | Planned |
| Resend | Transactional email | Email addresses, message content | US | Planned |
| Sentry | Error monitoring | Technical logs, pseudonymous user IDs | EU | Planned |
| PostHog | Product analytics (consented) | Pseudonymous usage events | EU | Planned |
| Deel | Contractor payouts and Employer of Record | Engineer identity and payment data | US, EU | Planned |
| WorkOS | Single sign-on and directory sync | Names, work emails, identity attributes | US | Planned |
| Liveblocks | Real-time SOW co-editing | Draft text, editor names | US | Planned |
| Credly | Verifiable credentials | Engineer name, skills, level | US | Planned |
| HackerRank | Technical assessments | Applicant test data | US | Planned |
Hosting regions (Riyadh, Frankfurt, Virginia) are planned and not contracted yet. A provider moves from Planned to In use only after its DPA is signed, with 30 days' notice to subscribers. Until then, client code and data stay in your own environment.
Your own tools that engineers use, such as your Slack, Jira or GitHub, aren't our subprocessors. You control them.
How data moves
Client data enters through Client OS or your own environment. Contracts and documents stay in your chosen region. Payment and signature data go only to the providers above. Engineer data flows to payout, assessment and background-check providers, never to clients beyond the anonymised profile.
Change log
No changes yet. The first entries appear when a provider moves from Planned to In use.
Get 30 days' notice of changes
Subscribe and we'll email you at least 30 days before a new subprocessor starts processing your data.
How to object
If you object to a new subprocessor on reasonable data-protection grounds, tell us within the 30-day notice period. We'll work with you on an alternative, such as keeping your data out of that provider's scope; if we can't, your DPA sets out your termination rights for the affected service.
Last reviewed
Last reviewed 1 October 2026 by Head of Governance & Trust
Frequently asked questions
A subprocessor is a third party that processes client personal data on Remote Pro Ai's behalf, such as our hosting, payment or e-signature providers. Under GDPR, Saudi PDPL and UAE PDPL, we must disclose them, bind them to data-protection terms and tell you before we add new ones.
At least 30 days. Subscribers get an email when the notice period starts, the change appears in the log on this page, and the effective date is shown. You can object during that window under the process in your DPA.
No subprocessor on this list is given access to your source code. Engineers work in your repositories under your access controls, and code stays in your environment or your chosen cloud region. The providers here handle identity, payments, signatures, payouts and assessments.
Yes. Today, keep all code and data in your own environment: our engineers work inside it, or inside your own cloud region in Saudi Arabia. Our own in-Kingdom hosting in Riyadh is planned for the platform launch and is not contracted yet. Some providers, such as payment networks, process limited data in their own regions; the table shows where.
We review your objection and propose an alternative, such as keeping your data out of the new provider's scope. If we can't resolve it within the 30-day notice period, you can end the affected service under your DPA without a termination fee for that part. The change log on this page records the outcome.
Download it as CSV from this page. It includes every column shown plus the review date. The same list is in the evidence bundle on the documents page, with a file hash so your auditors can confirm it hasn't changed.