Sub-processors

Every company that receives personal data because we sent it to them, in the ordinary running of Neptune Atlas. This page is the authoritative version: the privacy notice and Annex 3 of the data processing agreement show the same list from the same source, so a company cannot appear in one document and be missing from another.

Current as of 13 October 2026. 16 entries. If you are reviewing this for a security questionnaire and need it as a signed document, write to support@neptunelabs.ca and we will send one.

• Amazon Web Services

  What they do
  The application, its Postgres database, our own CRM, and the phone server our line rings on

  What reaches them
  Everything in a desk, every account record, our customer and prospect records, and the numbers on a call

  Location
  Frankfurt, Germany (eu-central-1) since 18 September 2026; the phone server is in Canada (ca-central-1). The earlier server in Mumbai, India is listed until its deletion is confirmed

• Amazon S3

  What they do
  Raw intake mail bodies, desk documents and attachments, and the encrypted nightly backup

  What reaches them
  Mail as sent, files a desk uploaded, and an encrypted copy of the database

  Location
  Frankfurt, Germany (eu-central-1) for intake mail, documents and attachments; Stockholm, Sweden (eu-north-1) for the backup. The earlier bucket in Mumbai, India is listed until its deletion is confirmed. No call audio is held

• Amazon SQS

  What they do
  The queue a message sits in between arriving and being read

  What reaches them
  The recipient token and a pointer to the stored message

  Location
  Frankfurt, Germany (eu-central-1)

• AWS Amplify and CloudFront

  What they do
  Serving the site and its static files

  What reaches them
  Your IP address and the pages you asked for

  Location
  Global edge network

• Amazon Simple Email Service

  What they do
  Sending e-mail we originate, and receiving mail sent to a desk's intake address

  What reaches them
  Verification codes, password resets, support replies, inbound mail

  Location
  Canada (ca-central-1) for sending; Frankfurt, Germany (eu-central-1) for receiving

• voip.ms

  What they do
  The telephone line Neptune Labs Inc. answers on

  What reaches them
  The numbers on a call, its time and length, and the call itself while it is in progress

  Location
  Canada

• Anthropic

  What they do
  Reading a scanned statement of facts, and researching a ship's ownership

  What reaches them
  The whole document as uploaded, including handwriting and names

  Location
  United States

• Microsoft

  What they do
  Graph and Entra ID, where a broker connects a Microsoft 365 or Outlook.com mailbox

  What reaches them
  Listings and message bodies from that mailbox, under Mail.Read and Mail.Send

  Location
  United States and Ireland

• Google Programmable Search

  What they do
  Finding a shipping company's own website, so the register can hold a real address

  What reaches them
  A company name and a country. Nothing of a customer's

  Location
  United States

• Google Analytics

  What they do
  Counting visits and which screens are used, once analytics is allowed

  What reaches them
  Pages, approximate location from IP, device, and your account and user numbers

  Location
  United States and Ireland

• Zoho Mail (Canadian data centre)

  What they do
  Our own mailbox, including the address every privacy request arrives at

  What reaches them
  Anything you write to us, including a data subject request

  Location
  Canada

• Stripe

  What they do
  Taking payment and holding card details

  What reaches them
  Billing name, e-mail, address, country and the card itself

  Location
  United States and Ireland

• Odoo S.A. (Odoo Online)

  What they do
  Our CRM until 9 October 2026, when we moved it to our own server. Nothing new is sent there. Listed until we have confirmed that the old database is deleted

  What reaches them
  As it stood on that date: desk and user names, work e-mails and telephone numbers, plan and usage counts, and notes of calls to us

  Location
  Region not confirmed with Odoo

• Datalastic

  What they do
  The vessel register, ownership records and AIS positions

  What reaches them
  Which ship or which sea area was asked for. No customer identity

  Location
  European Union

• Cloudflare

  What they do
  DNS for the domain and the www redirect

  What reaches them
  The name your browser looked up

  Location
  Global edge network

• OpenFreeMap and AWS Terrain Tiles

  What they do
  Map tiles, fetched by your browser when a chart is on screen

  What reaches them
  Your IP address and the tile coordinates. Not who you are

  Location
  Global edge network

Each is used under the data processing terms that provider publishes for its service. We have not yet confirmed and filed a dated copy of each one, so we do not claim here that every one of them is no less protective than the terms we owe you; we remain liable to you for what they do either way. Where one holds a certification under the EU-US Data Privacy Framework, we rely on it; where one does not, the transfer relies on that provider's standard contractual clauses. Our own storage moved from India to Germany on 18 September 2026; what that changes, and the copy that may remain in India, is in Annex 4, which is under review.

These companies are part of the product but are not sub-processors. The reason is given for each one.

Data vendors we buy from rather than send to. MagicPort's ownership export, an EU MRV import, and various public registers. Data comes from them and nothing of yours goes to them.

Equasis. A public maritime information service, queried one ship at a time by IMO number. What is sent is a ship's number. No customer identity goes with it, and we never look up ships in bulk.

Your own e-mail provider. Where you connect an IMAP mailbox, the connection is direct to your provider with your own sign-in details and adds nobody to this list. Microsoft is on the list because a Microsoft 365 mailbox is reached through an application we registered and control, which is a different arrangement and was previously described here as though it were the same one.

Your own data vendor. Where your plan lets you supply an API key, that contract is yours.

Our CRM. Since 9 October 2026 our customer records live in an Odoo instance we run ourselves, on the same server as the application. From August 2026 until that date they were in Odoo Online, which Odoo S.A. runs. Odoo S.A. stays in the list above until we have confirmed that the old database is deleted, and the change log says when each description was corrected.

The two map tile services are on the list rather than off it, even though what reaches them is only your IP address and which part of the map you asked for. You cannot easily see for yourself when your browser sends a request to another company, so we disclose it.

Before a new sub-processor starts, we publish it here with a dated entry in the log below and e-mail the account owner at least 30 days beforehand. The announcement comes first and the change follows it. This order is a term of the data processing agreement, not a courtesy.

Within those 30 days you may object on reasonable data protection grounds by writing to support@neptunelabs.ca. We will look for an alternative arrangement, and if there is none you may end the affected part of your subscription without penalty and we will refund the unused part of any period paid in advance.

There is one exception: where a sub-processor has to be replaced urgently for security or continuity, we may make the change first and tell you without delay. Your right to object and to leave is unaffected.

To be told when this page changes, write to support@neptunelabs.ca and ask. There is no subscription form yet; the account owner is e-mailed regardless.

Newest first. Entries are added and never edited, so the history cannot be rewritten.

• 13 October 2026

  A correction of the list to three moves already made, none of them published 30 days ahead as the DPA promises. Amazon Connect and Amazon Contact Lens removed, with the two functions that served them: we stopped using them on 19 September 2026 and deleted them. voip.ms added, which has carried our telephone line since then. Odoo S.A. changed from our CRM to our former CRM: since 9 October 2026 the CRM runs on our own server, and the row stays until the old database is confirmed deleted. The locations were also wrong: the application, its database and its storage moved from Mumbai, India to Frankfurt, Germany on 18 September 2026, and the nightly backup has gone to Stockholm, Sweden since the same month.

• 16 September 2026

  Odoo S.A. added. Our CRM was described on this page, in the privacy notice and in the DPA as an instance we run ourselves on our own infrastructure and not a third party. Since August 2026 it has been Odoo Online, which Odoo S.A. runs, and the description was wrong from then. This corrects the list rather than announcing a new arrangement, and it was not published 30 days ahead as the DPA promises. That is stated here rather than left to be found.

• 29 August 2026

  Six additions, all of them disclosures of parties already in the request path rather than new arrangements: Anthropic, Microsoft Graph, Google Programmable Search, Zoho Mail, Amazon Contact Lens, and the S3, SQS and Lambda services split out from the single Amazon Web Services row that had been standing for them. This is a correction of an incomplete list and not a change of processing. The list was nine and should have been fifteen.

• 20 August 2026

  First published list: Amazon Web Services, Amplify and CloudFront, Simple Email Service, Amazon Connect, Stripe, Google Analytics, Datalastic, Cloudflare, and the two map tile services.

Questions about anybody on this list, a signed copy for your files, or a security questionnaire: support@neptunelabs.ca.