Subprocessors
Exhibit C to the Data Processing Agreement. Microsoft Azure and Twilio apply to every deployment; everything else is issued as a completed exhibit for your environment.
Last updated 23 July 2026 · Exhibit C to the Data Processing Agreement · Version v.260723
1. How this register works
A8 Core™ is deployed for financial institutions, custodians and administrators, and the third parties involved in processing depend on what a given deployment does. A single fixed list published for everyone would be wrong for almost everyone — either overstating the parties who touch your data, or omitting one that a specific integration introduces.
So this register has two tiers. Constants apply to every deployment. Deployment-specific entries are issued as a completed exhibit for your environment, and are the authoritative list for you.
This page is a register, not a claim of completeness for your deployment. If you need a definitive list to put in front of your own vendor-risk committee, request the completed exhibit for your environment — see clause 5.
2. Constants — every deployment
| Subprocessor | Purpose | Applies to |
|---|---|---|
| Microsoft Azure | Hosting, compute, storage and networking for all environments | All deployments |
| Twilio | SMS and telephony, including operational and security notifications | All deployments |
Hosting region is a configurable property of a deployment. If you have a data-residency constraint, raise it before provisioning — changing region after data exists is a migration, not a setting.
3. Deployment-specific
The following categories are engaged only where the deployment uses them. The named party, its role and its region are recorded in your completed exhibit.
| Category | Engaged when |
|---|---|
| Document execution and electronic signature — for example DocuSign | The deployment executes agreements or account documents electronically |
| Identity verification, sanctions and watchlist screening | The deployment performs KYC, KYB or ongoing screening |
| Payment, transfer and settlement rails | The deployment moves funds |
| Market, valuation and reference data | The deployment values positions or reports pricing |
| Tax reporting and information return production | The deployment produces information returns |
| Customer support, ticketing and communication tooling | The institution uses our supported support channels |
| Observability, logging and error reporting | Standard for production deployments; region-configurable |
4. Notice and objection
Under clause 6 of the DPA we give notice of an intended new or replacement subprocessor that will process your personal data, with a reasonable period to object on reasonable data-protection grounds. To receive those notices, send the address that should receive them to legal@a8core.com. Notices go to a named address rather than being published here, so that a change reaches your vendor-risk owner rather than waiting to be noticed.
5. Requesting your deployment register
Email legal@a8core.com with your institution and environment. The completed Exhibit C is issued alongside Exhibit A (nature of processing) and Exhibit B (technical and organisational measures), which together are what a vendor-risk review normally asks for.
This register is published for transparency and is accurate as of the date shown. It does not create rights beyond those in the Data Processing Agreement and your platform agreement.
Questions about this document? Contact legal@a8core.com or write to Financial Infrastructure, Inc., PO Box 1410, Menlo Park, California 94026-1410.