Sub-processors

Every company that receives personal data because we sent it to them, in the ordinary running of Neptune Atlas. This page is the authoritative version: the privacy notice and Annex 3 of the data processing agreement render the same list from the same source, so a company cannot appear in one document and be missing from another.

Current as of 16 September 2026. 18 entries. If you are reviewing this for a security questionnaire and need it as a signed document, write to support@neptunelabs.ca and we will send one.

• Amazon Web Services

  What they do
  The application and its Postgres database

  What reaches them
  Everything in a desk, and every account record

  Location
  Mumbai, India (ap-south-1)

• Amazon S3

  What they do
  Raw intake mail bodies, desk documents and attachments, call audio

  What reaches them
  Mail as sent, files a desk uploaded, recordings of calls to us

  Location
  Mumbai, India for documents and attachments; call audio in Canada (ca-central-1); intake mail in a region not yet confirmed

• Amazon SQS

  What they do
  The queue a message sits in between arriving and being read

  What reaches them
  The recipient token and a pointer to the stored message

  Location
  Region not yet confirmed

• AWS Lambda

  What they do
  Two small functions on the telephony path: caller lookup, and collecting the transcript

  What reaches them
  A calling number, and a finished call's transcript

  Location
  Canada (ca-central-1)

• AWS Amplify and CloudFront

  What they do
  Serving the site and its static files

  What reaches them
  Your IP address and the pages you asked for

  Location
  Global edge network

• Amazon Simple Email Service

  What they do
  Sending e-mail we originate, and receiving mail sent to a desk's intake address

  What reaches them
  Verification codes, password resets, support replies, inbound mail

  Location
  Canada (ca-central-1)

• Amazon Connect

  What they do
  The telephone line Neptune Labs answers on

  What reaches them
  Numbers, times, durations, and audio where recording is on

  Location
  Canada (ca-central-1)

• Amazon Contact Lens

  What they do
  Automated analysis of a recorded call: transcription, speaker labels, a summary

  What reaches them
  The words spoken on a call to or from Neptune Labs

  Location
  Canada (ca-central-1)

• Anthropic

  What they do
  Reading a scanned statement of facts, and researching a hull's ownership

  What reaches them
  The whole document as uploaded, including handwriting and names

  Location
  United States

• Microsoft

  What they do
  Graph and Entra ID, where a broker connects a Microsoft 365 or Outlook.com mailbox

  What reaches them
  Listings and message bodies from that mailbox, under Mail.Read and Mail.Send

  Location
  United States and Ireland

• Google Programmable Search

  What they do
  Finding a shipping company's own website, so the register can hold a real address

  What reaches them
  A company name and a country. Nothing of a customer's

  Location
  United States

• Google Analytics

  What they do
  Counting visits and which screens are used, once analytics is allowed

  What reaches them
  Pages, approximate location from IP, device, and your account and user numbers

  Location
  United States and Ireland

• Zoho Mail (Canadian data centre)

  What they do
  Our own mailbox, including the address every privacy request arrives at

  What reaches them
  Anything you write to us, including a data subject request

  Location
  Canada

• Stripe

  What they do
  Taking payment and holding card details

  What reaches them
  Billing name, e-mail, address, country and the card itself

  Location
  United States and Ireland

• Odoo S.A. (Odoo Online)

  What they do
  Our CRM: customer and prospect records, subscriptions, draft invoices, and the log of calls to our own telephone line

  What reaches them
  Desk and user names, work e-mails and telephone numbers, plan and usage counts, and notes and transcripts of calls to us

  Location
  Region not yet confirmed with Odoo

• Datalastic

  What they do
  The vessel register, ownership records and AIS positions

  What reaches them
  Which hull or which sea area was asked for. No customer identity

  Location
  European Union

• Cloudflare

  What they do
  DNS for the domain and the www redirect

  What reaches them
  The name your browser looked up

  Location
  Global edge network

• OpenFreeMap and AWS Terrain Tiles

  What they do
  Map tiles, fetched by your browser when a chart is on screen

  What reaches them
  Your IP address and the tile coordinates. Not who you are

  Location
  Global edge network

Each is used under the data processing terms that provider publishes for its service. We have not yet confirmed and filed a dated copy of each one, so we do not claim here that every one of them is no less protective than the terms we owe you; we remain liable to you for what they do either way. Where one holds a certification under the EU-US Data Privacy Framework, we rely on it; where one does not, the transfer rides on that provider's standard contractual clauses. The transfer to India is a separate question, and Annex 4 says it is under review.

A list that quietly includes everybody we have ever dealt with is as unhelpful as one that omits the six that matter. These are in the product and are not sub-processors, with the reason in each case.

Data vendors we buy from rather than send to. MagicPort's ownership export, an EU MRV import, and various public registers. Data comes from them and nothing of yours goes to them.

Equasis. A public maritime information service, queried one hull at a time by IMO number. What is sent is a ship's number. No customer identity goes with it, and there is no bulk sweep.

Your own e-mail provider. Where you connect an IMAP mailbox, the connection is direct to your provider under your credential and adds nobody to this list. Microsoft is on the list because a Microsoft 365 mailbox is reached through an application we registered and control, which is a different arrangement and was previously described here as though it were the same one.

Your own data vendor. Where your plan lets you supply an API key, that contract is yours.

Our CRM used to be listed here, and should not have been. This paragraph said our customer records lived in an Odoo instance we ran ourselves. Since August 2026 they have been in Odoo Online, which Odoo S.A. runs, so Odoo is now in the list above and the change log says when the description was corrected.

The two map tile services are on the list rather than off it, even though what reaches them is only your IP address and which square of sea you asked for. A request your own browser makes to somebody else is exactly the thing you cannot discover for yourself, so it is disclosed.

Before a new sub-processor starts, we publish it here with a dated entry in the log below and e-mail the account owner at least 30 days beforehand. The announcement comes first and the change follows it. That ordering is the whole value of the promise and it is a term of the data processing agreement, not a courtesy.

Within those 30 days you may object on reasonable data protection grounds by writing to support@neptunelabs.ca. We will look for an alternative arrangement, and if there is none you may end the affected part of your subscription without penalty and we will refund the unused part of any period paid in advance.

One exception, stated because the alternative is a promise that breaks the first time it is tested: where a sub-processor has to be replaced urgently for security or continuity, we may make the change first and tell you without delay. Your right to object and to leave is unaffected.

To be told when this page changes, write to support@neptunelabs.ca and ask. There is no subscription form yet; the account owner is e-mailed regardless.

Newest first. Entries are added and never edited, because a change log that can be rewritten is not one.

• 16 September 2026

  Odoo S.A. added. Our CRM was described on this page, in the privacy notice and in the DPA as an instance we run ourselves on our own infrastructure and not a third party. Since August 2026 it has been Odoo Online, which Odoo S.A. runs, and the description was wrong from then. This corrects the list rather than announcing a new arrangement, and it was not published 30 days ahead as the DPA promises. That is stated here rather than left to be found.

• 29 August 2026

  Six additions, all of them disclosures of parties already in the request path rather than new arrangements: Anthropic, Microsoft Graph, Google Programmable Search, Zoho Mail, Amazon Contact Lens, and the S3, SQS and Lambda services split out from the single Amazon Web Services row that had been standing for them. This is a correction of an incomplete list and not a change of processing. The list was nine and should have been fifteen.

• 20 August 2026

  First published list: Amazon Web Services, Amplify and CloudFront, Simple Email Service, Amazon Connect, Stripe, Google Analytics, Datalastic, Cloudflare, and the two map tile services.

Questions about anybody on this list, a signed copy for your files, or a security questionnaire: support@neptunelabs.ca.