> ## Documentation Index
> Fetch the complete documentation index at: https://docs.modulex.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Sub-processors

> The third parties ModuleX uses to deliver the service, what each one does, where its access is limited, and how ModuleX tells you when the list changes.

export const MediaEmbed = ({id, type = 'screenshot', caption = '', ext, ratio = '16 / 9'}) => {
  const isVideo = type === 'video' || type === 'app_video';
  const resolvedExt = ext || (isVideo ? 'mp4' : type === 'screenshot' ? 'webp' : 'svg');
  const src = 'https://media.modulex.dev/' + id + '.' + resolvedExt;
  const [status, setStatus] = useState('loading');
  const [isDev, setIsDev] = useState(false);
  const [inView, setInView] = useState(false);
  const boxRef = useRef(null);
  useEffect(() => {
    if (typeof window === 'undefined') return;
    const h = window.location.hostname;
    setIsDev(h === 'localhost' || h === '127.0.0.1' || h.endsWith('.mintlify.app'));
  }, []);
  useEffect(() => {
    if (inView) return;
    if (typeof IntersectionObserver === 'undefined') {
      setInView(true);
      return;
    }
    const el = boxRef.current;
    if (!el) return;
    const io = new IntersectionObserver(entries => {
      if (entries.some(e => e.isIntersecting)) {
        setInView(true);
        io.disconnect();
      }
    }, {
      rootMargin: '300px'
    });
    io.observe(el);
    return () => io.disconnect();
  }, [inView]);
  if (status === 'missing') {
    if (!isDev) return null;
    return <div style={{
      display: 'flex',
      flexDirection: 'column',
      justifyContent: 'center',
      gap: '0.4rem',
      padding: '1rem 1.25rem',
      margin: '1.25rem 0',
      width: '100%',
      aspectRatio: ratio,
      boxSizing: 'border-box',
      border: '1px dashed rgba(128,128,128,0.45)',
      borderRadius: '0.75rem',
      background: 'rgba(128,128,128,0.06)',
      color: 'currentColor',
      fontSize: '0.85rem',
      lineHeight: 1.45
    }}>
        <div style={{
      display: 'flex',
      alignItems: 'center',
      gap: '0.5rem',
      opacity: 0.75
    }}>
          <span aria-hidden="true">🎬</span>
          <code style={{
      fontSize: '0.75rem'
    }}>{id}</code>
          <span style={{
      fontSize: '0.65rem',
      textTransform: 'uppercase',
      letterSpacing: '0.04em',
      padding: '0.1rem 0.4rem',
      borderRadius: '0.4rem',
      background: 'rgba(128,128,128,0.18)'
    }}>
            {type}
          </span>
        </div>
        <div style={{
      opacity: 0.9
    }}>{caption || 'Media not uploaded yet.'}</div>
        <div style={{
      fontSize: '0.7rem',
      opacity: 0.5
    }}>
          Upload to R2 as <code>{id}.{resolvedExt}</code> — preview only, hidden in production.
        </div>
      </div>;
  }
  const mediaStyle = {
    display: status === 'loaded' ? 'block' : 'none',
    width: '100%',
    height: 'auto',
    borderRadius: '0.75rem'
  };
  const media = isVideo ? <video src={inView ? src : undefined} autoPlay loop muted playsInline preload="metadata" onLoadedData={() => setStatus('loaded')} onError={() => setStatus('missing')} style={mediaStyle} /> : <img src={inView ? src : undefined} alt={caption} onLoad={() => setStatus('loaded')} onError={() => setStatus('missing')} style={mediaStyle} />;
  return <figure style={{
    margin: '1.25rem 0'
  }}>
      <div ref={boxRef} style={status === 'loaded' ? {
    width: '100%'
  } : {
    width: '100%',
    aspectRatio: ratio,
    borderRadius: '0.75rem',
    background: 'rgba(128,128,128,0.06)'
  }}>
        {media}
      </div>
      {status === 'loaded' && caption ? <figcaption style={{
    marginTop: '0.5rem',
    textAlign: 'center',
    fontSize: '0.85rem',
    opacity: 0.7
  }}>
          {caption}
        </figcaption> : null}
    </figure>;
};

A sub-processor is a third-party company that ModuleX uses to run the service, and that may process some of your data while doing its part of the job. ModuleX's [Privacy Policy](https://modulex.dev/privacy-policy) calls these companies "Service Providers"; under the GDPR they are your data processors' processors. This page lists them, says what each one does, and explains how ModuleX tells you when the list changes.

For the wider picture of how your data is handled and what compliance commitments apply, see [Trust & data handling](/security/trust) and [Compliance](/security/compliance).

<CardGroup cols={3}>
  <Card title="A short, purposeful list" icon="list-checks" href="#who-processes-your-data">
    Each third party does one job, such as hosting, payments, email, or AI model calls.
  </Card>

  <Card title="Limited by design" icon="lock" href="#what-each-one-can-touch">
    A sub-processor only ever sees the data it needs for its task, and cannot use it for anything else.
  </Card>

  <Card title="Changes are announced" icon="bell" href="#how-changes-are-announced">
    When the list changes, ModuleX updates the Privacy Policy and notifies you before it takes effect.
  </Card>
</CardGroup>

## Who processes your data

The list below comes from ModuleX's published [Privacy Policy](https://modulex.dev/privacy-policy) (last updated May 22, 2026). It is grouped by what each third party does. The Privacy Policy is the authoritative, dated version of this list; the table here is a plain-language summary that points back to it.

<Note>
  ModuleX is operated by ModulexAI, LLC. The list here reflects the Service Providers named in the Privacy Policy. If you need a formal, signed sub-processor schedule or a Data Processing Agreement for a contract, see [Compliance](/security/compliance) or contact the ModuleX team.
</Note>

<CardGroup cols={2}>
  <Card title="Cloud infrastructure" icon="server">
    Hosts the application, databases, and stored files that keep ModuleX running.

    **Provider:** Amazon Web Services
  </Card>

  <Card title="Payments" icon="credit-card" href="/concepts/credits-billing">
    Processes subscription and top-up payments. ModuleX never stores your card details; they go straight to the processor.

    **Provider:** Stripe
  </Card>

  <Card title="Email delivery" icon="mail">
    Sends transactional email such as sign-in, billing, and notification messages.

    **Providers:** SendGrid, Postmark
  </Card>

  <Card title="Product analytics" icon="chart-bar">
    Measures how the product is used so ModuleX can improve it. Tied to usage, not to your workflow content.

    **Provider:** PostHog
  </Card>

  <Card title="Error monitoring" icon="bug">
    Captures application errors so ModuleX can find and fix problems.

    **Provider:** Sentry
  </Card>

  <Card title="AI model providers" icon="sparkles" href="/integrations/llm-providers/overview">
    Run the language models behind ModuleX-managed AI features. Bound by their no-training commitments for API customers.

    **Providers:** OpenAI, Anthropic, Google Gemini
  </Card>
</CardGroup>

<MediaEmbed id="MX-MEDIA-4280" type="image" caption={"A simple grouped diagram showing ModuleX in the center with six labeled categories of sub-processor around it (cloud infrastructure, payments, email, analytics, error monitoring, AI model providers), each with the named provider underneath."} />

## What each one can touch

Sub-processors are not given open access to your account. Each one only handles the slice of data its job requires.

<Tabs>
  <Tab title="The narrow-access rule">
    Every third party above can access your information only to perform its specific task for ModuleX, and is contractually obligated not to disclose it or use it for any other purpose. A payment processor sees billing data, not your workflow content; an email provider sees the message it sends, not your knowledge base.
  </Tab>

  <Tab title="AI providers and your content">
    Your prompts, workflow content, and connected-service data may be sent to an AI model provider so a managed AI feature can run. Per these providers' published API customer commitments, data routed through their APIs is not used to train their models, and ModuleX does not use your content to train any model, its own or a third party's. Processing is real-time; nothing is retained by ModuleX for training. See [AI processing](https://modulex.dev/privacy-policy) in the Privacy Policy for the exact wording.
  </Tab>

  <Tab title="Payment data">
    ModuleX does not store or collect your payment card details. That information is provided directly to the payment processor, whose handling is governed by its own privacy policy and PCI-DSS standards. See [Credits & the billing model](/concepts/credits-billing) for how billing works.
  </Tab>
</Tabs>

## When BYOK keeps a provider off this list

When you bring your own model or tool provider with [BYOK](/concepts/credits-billing) (Bring Your Own Key), your data goes directly to that provider under your own account, governed by your agreement with them. In that case the provider is not acting as a ModuleX sub-processor for that traffic.

<CardGroup cols={2}>
  <Card title="Managed usage" icon="sparkles" href="/integrations/llm-providers/overview">
    When you use ModuleX-managed models, calls run through ModuleX's provider accounts, so those AI providers are sub-processors and the list above applies.
  </Card>

  <Card title="Your own keys (BYOK)" icon="key">
    When you connect your own provider key, your data flows directly to that provider under your account and terms. That provider is yours to manage, not a ModuleX sub-processor.
  </Card>
</CardGroup>

## How changes are announced

ModuleX maintains this list through its [Privacy Policy](https://modulex.dev/privacy-policy), which carries a dated "Last updated" header so you can see when it last changed.

<Steps>
  <Step title="The Privacy Policy is updated">
    The new or removed third party is reflected in the published Privacy Policy, and the "Last updated" date at the top is changed.
  </Step>

  <Step title="You are notified before it takes effect">
    ModuleX states that it will notify you by email and/or a prominent notice in the service before a material change becomes effective.
  </Step>

  <Step title="You decide what to do">
    Review the change. If you have a question or a contractual notice requirement, raise it through the contacts on the [Compliance](/security/compliance) page before the change takes effect.
  </Step>
</Steps>

<Note>
  Want advance notice in writing, or a formal way to object to a new sub-processor? Those terms belong in a Data Processing Agreement rather than the public Privacy Policy. See [Compliance](/security/compliance) for how to request one.
</Note>

## Open points to verify

ModuleX does not invent facts in these docs. A few details about the sub-processor list are not fully settled in the verified sources, so they are flagged here rather than stated as fact.

<Warning>
  **Cloud infrastructure provider — TBD.** The public Privacy Policy names **Amazon Web Services** as the cloud infrastructure provider, while ModuleX's backend configuration references **Microsoft Azure** services (managed secret storage and file storage) and **Clerk** for sign-in. These sources do not currently agree, and Azure and Clerk are not listed in the Privacy Policy. Treat the published Privacy Policy list as authoritative for now, and confirm the operative infrastructure, secret-storage, and identity providers with the ModuleX team before relying on a specific vendor. This will be reconciled on the [Compliance](/security/compliance) page.
</Warning>

<Warning>
  **Regions, retention, and a signed schedule — TBD.** This page does not assert where each sub-processor stores data, how long it retains it, or a contractually binding sub-processor schedule. Those belong in a Data Processing Agreement and the [Compliance](/security/compliance) page. Confirm them there, or with the ModuleX team, before relying on them.
</Warning>

## Where to go next

<CardGroup cols={3}>
  <Card title="Compliance" icon="clipboard-check" href="/security/compliance">
    ModuleX's compliance posture, certifications, and how to request a Data Processing Agreement.
  </Card>

  <Card title="Trust & data handling" icon="shield-check" href="/security/trust">
    How ModuleX isolates, protects, and retains your data, in plain language.
  </Card>

  <Card title="Data security & encryption" icon="lock" href="/security/data-encryption">
    How credentials and secrets are encrypted, plus key management and production checks.
  </Card>
</CardGroup>