Sub-processors
Effective 25 June 2026 · version 1.0 (draft)
Exec X AI Ltd engages the third-party processors below to deliver the service. Each is bound by a written agreement no less protective than our data processing addendum (Article 24 of the DIFC DPL). We give prior notice of material changes; customers may object by writing to privacy@regulation10.ae.
1. Current sub-processors
| Sub-processor | Purpose | Region | Transfer mechanism | Applies to |
|---|---|---|---|---|
| Microsoft Azure | Hosting, compute, Cosmos DB, WORM blob storage, AI inference (Azure OpenAI), and the self-hosted site analytics we run ourselves | UAE North (data at rest); judgement inference: deployment provisioned in UAE North on the Global Standard type, which Microsoft documents as processable in any Azure region; classify and redact inference: Sweden Central on the Data Zone Standard type (EU data zone); site analytics: Sweden Central (EU data zone) | In country for data at rest; DIFC standard contractual clauses (Article 27) for any onward transfer, including inference processed outside the UAE and the aggregate site analytics processed in Sweden Central | Both |
| Stripe | Subscription billing and payment processing | United States and EU | DIFC standard contractual clauses (Article 27) plus the Stripe data processing agreement | Platform |
| Resend | Transactional and notification email delivery | United States and EU | DIFC standard contractual clauses (Article 27) plus the provider data processing agreement | Both |
| Vercel | Marketing-site hosting and CDN | Global edge | DIFC standard contractual clauses (Article 27) plus the provider data processing agreement | Marketing |
2. How to read this register
“Platform” entries process authenticated customer data on regulation10.ae. “Marketing” entries process enquiry and analytics data from our public marketing site. “Both” entries do each.
Tenant data is resident at rest in the Azure UAE North region. Classify and redact inference runs on an Azure OpenAI deployment in Azure Sweden Central, on the Data Zone Standard deployment type, processed within Microsoft's EU data zone, which is on the DIFC adequacy list. Judgement and explain inference runs on a deployment provisioned in UAE North on the Global Standard deployment type, which Microsoft documents as capable of being processed in any Azure region. We therefore commit to where data is stored at rest and to where each inference deployment is provisioned, and we make no claim that inference is executed in country.
This register is a disclosure of actual data flows. A vendor we do not send data to is not listed, and any new flow to a new vendor is added here before the flow starts. See our privacy policy for the full residency and transfer position.
3. Objecting to a change
If you object to a new sub-processor, write to privacy@regulation10.ae within the notice period stated in your agreement, setting out the grounds of your objection.