These third parties may process customer data on CME's behalf as part of delivering the Service. We notify customers by email + in-product banner 30 days before adding a new subprocessor.
Vendor
Purpose
Storage location
Transfer
Amazon Web Services (AWS)
Cloud hosting · Bedrock inference · S3 / Postgres / KMS
us-east-1, us-west-2 (Enterprise EU: eu-west-1, eu-central-1)
US (EU SCCs in place)
Anthropic (via AWS Bedrock)
LLM inference for the agent loop + corpus extraction
AWS Bedrock-managed inference path inside our AWS account
US (EU SCCs in place via AWS)
WorkOS
SSO + SAML + SCIM + AdminPortal for customer auth
United States
US (DPA + SCCs in place)
Stripe
Subscription billing + payment processing
United States
US (DPA + SCCs in place)
Sentry
Error tracking + performance monitoring
United States
US (DPA + SCCs in place)
Resend
Transactional email (login, audit complete, billing)
United States
US (DPA + SCCs in place)
PostHog (self-hosted)
Product analytics + feature-flag evaluation
United States, on AWS in CME's account
US
Vercel
Marketing site hosting (cmeexample.com static + ISR)
United States
US (DPA + SCCs in place)