NecessityWorks Subprocessors

Published at: https://necessityworks.com/legal/subprocessors Last updated: 2026-09-02 Current version: 1.0 Authority: This page is the single authoritative source of the third-party subprocessors that NecessityWorks, Inc. (“NW”) engages to Process Customer Personal Data, as required by NW’s Data Processing Addendum (DPA).

---

What is a Subprocessor?

A Subprocessor is a third party engaged by NW to Process Customer Personal Data on NW’s behalf in connection with delivery of the NW Platform.

Not Subprocessors:

• Open-source software that NW hosts and operates within its own AWS infrastructure (e.g., databases, runtimes, agents). The underlying infrastructure provider (AWS) is the Subprocessor for those components, not the open-source project itself.
• Customer’s own integrations that Customer chooses to connect to the Platform (e.g., Customer’s SIEM, Customer’s identity provider). Customer remains the Controller of Personal Data flowing through those integrations.
• Carriers and last-mile providers (e.g., DNS, ISPs, transit networks) that route encrypted traffic without access to plaintext Customer Data.

This definition aligns with DPA §1.10.

---

Current Subprocessors

The following third parties are NW’s authorized Subprocessors as of the date above:

#	Subprocessor	Legal Entity	Purpose of Processing	Location of Processing
1	Amazon Web Services	Amazon Web Services, Inc. (Delaware)	Infrastructure hosting (compute, storage, networking, managed databases, identity, and related cloud services) for the NW Platform. AWS is the sole cloud infrastructure provider.	United States (primary). EEA regions available on request per the applicable Order Form.
2	Anthropic	Anthropic, PBC (Delaware)	Large-language-model inference for the MAAV AI assistant and related AI-enabled features of the Platform.	United States.
3	OpenAI	OpenAI, L.L.C. (Delaware)	Large-language-model inference, used only where a Customer expressly opts in via tenant configuration.	United States.
4	Stripe	Stripe, Inc. (Delaware)	Payment processing, billing, invoicing, and tax calculation for Customer subscriptions.	United States.
5	Google	Google LLC (Delaware)	Business email delivery (Google Workspace) for NW’s transactional and account communications with Customer; marketing/contact form intake on NW’s marketing website.	United States.
6	Cloudflare	Cloudflare, Inc. (Delaware)	Edge networking, web application firewall (WAF), DDoS protection, and TLS termination for NW’s public-facing endpoints.	Global edge network; data plane primarily United States.

No other third parties receive Customer Personal Data from NW in the ordinary course of providing the Services. If NW engages a new Subprocessor, this page is updated and the change-notification list (below) receives an email at least thirty (30) days in advance, per DPA §4.3.

---

Subprocessors NW Does NOT Use

To remove ambiguity for procurement and security-review teams, NW affirmatively notes the following:

• No other cloud provider is used. NW does not host any production workload on Google Cloud, Microsoft Azure, Oracle Cloud, IBM Cloud, Alibaba Cloud, Tencent Cloud, or any other public-cloud provider.
• No observability or monitoring SaaS processes Customer Personal Data. NW operates its observability stack within its own AWS environment.
• No data-broker, ad-tech, marketing-automation, lookalike-modeling, audience-network, or behavioral-analytics platform receives any Customer Data or Customer Personal Data. NW does not sell or share Customer Data — see DPA §3.4 and MSA §6.4.
• No third-party “AI training” service receives Customer Data. NW does not transmit raw Customer Data content to any third party for model training. See MSA §6.3.

---

Change Notifications

NW provides at least thirty (30) days’ advance notice before authorizing a new Subprocessor or expanding the scope of an existing Subprocessor’s Processing, per DPA §4.3.

Subscribe to change notifications:

• Email list: Send an email to [email protected] with the subject line subscribe. You will receive an automated confirmation and be added to the change-notification list. Subscriptions are per email address; unsubscribe at any time via the link in any notice email.
• RSS feed: https://necessityworks.com/legal/subprocessors.rss (forthcoming)
• Version history below — updated whenever this page changes.

Right to object. Per DPA §4.4, a Customer may object, in writing and on reasonable data-protection grounds, to a proposed new Subprocessor within the thirty-day notice period.

---

Version History

Change log for this page. Every material change is recorded here with the effective date, what changed, and the version number. The current effective version is at the top.

Version	Effective Date	Change	Notes
1.0	2026-09-02	Initial publication. Subprocessors: AWS, Anthropic, OpenAI, Stripe, Google, Cloudflare.	Launch baseline.

When a future change occurs (e.g., adding a new Subprocessor or removing one), a new row is added at the top. Prior versions remain in the table indefinitely so Customers can reconstruct the Subprocessor state on any past date.

---

Contact

For questions about NW’s Subprocessors, processing practices, or this page:

• Privacy / Data Protection: [email protected]
• Legal: [email protected]
• Mailing address: NecessityWorks, Inc., 2810 N Church St #550982, Wilmington, DE 19802-4447, Attn: Privacy

---

Related Documents

• Master Subscription Agreement — §6.4 (Anti-Sale) and §6.3 (No AI Training)
• Data Processing Addendum — §4 (Subprocessors), §1.10 (Subprocessor definition)
• Security Addendum — TOMs applied to Subprocessor relationships
• Privacy Policy