Subprocessors

1. What this list is, and how it was built

CYBER WAVE INC., a corporation existing under the laws of Ontario, Canada (Ontario Corporation Number 1000780137), located in Markham, Ontario, Canada ("CyberWave", "we", "us" or "our") publishes this list of the service providers that may process Customer Data in delivering CyberWave Sentinel and our related services.

This is the authoritative list. The Data Processing Addendum refers to it rather than reproducing it, so that there is exactly one version of it and the two documents cannot disagree.

How it was built, because that is the part worth trusting. The list is built from the production configuration: the services actually configured, the database region, where the application and the website are hosted, the DNS records, and what the live pages actually set and load. It was not assembled from the dependency list in our source code.

That distinction produces a materially different list. Our codebase contains an error-tracking library, a product analytics library and a hosted cache client. None of the three is configured in production. A list generated from our dependency file would have named three providers that receive nothing from us. Section 6 names them anyway, as exclusions with reasons, because a reader who finds them in our source code deserves an explanation rather than a gap.

Naming a provider that receives nothing is as inaccurate as omitting one that does. Both misrepresent where Customer Data goes. And an over-inclusive list has a second cost: removing a provider later reads as a change in practice when nothing actually changed.

2. Defined terms

3. Where Customer Data is stored, and where it is processed

These are two different questions and we answer them separately, because merging them is how vendors end up making a claim they cannot support.

We do not say that all data stays in Canada, because it does not. Our primary datastore (database, authentication and file storage) is in Canada, which is genuine and deliberate. But:

• Application compute runs in the United States. Every request, and every piece of data inside that request, is processed on US infrastructure before it reaches the Canadian database. The cyberwave.ca marketing website is also hosted in the United States.
• AI features send request content to the United States. Those requests are sent from CyberWave's servers, never from your browser.
• Application and account email is sent through a provider in the United States.
• Payment processing for paid subscriptions may take place in the United States and globally.
• Our support mailbox may be processed outside Canada.

The accurate statement is therefore: Customer Data is primarily stored in Canada; application processing, website hosting, AI features, email delivery, payment processing and our support mailbox involve service providers that may process data outside Canada, including in the United States. Those providers process the data their service needs, for example billing records at the payment processor and message content at the email provider. Separately, the application's offline page cache is kept in the user's own browser.

Canadian federal privacy law permits transferring personal information to a provider in another country for processing, and treats that transfer as a use rather than a disclosure, so no separate consent is required for the transfer itself. What it does require is accountability and transparency: a written arrangement providing comparable protection, and telling people plainly that their information may be processed abroad and while there may be accessible to the courts, law enforcement and national security authorities of that country. A contract cannot override a lawful order made in another country, and we will not represent that it can.

4. The subprocessor list — overview

5. The subprocessor list — detail

5.1 Supabase

Note on tenant isolation. Separation between Customers inside that database is enforced by PostgreSQL row-level security and by server-side authorisation in the application. That is our control, not the provider's.

5.2 Vercel

5.3 Anthropic

What CyberWave does and does not do with your content. These statements describe our own conduct:

• AI features are assistive and optional. Outputs may contain errors and must be reviewed.
• There is no training or fine-tuning pipeline in the product. CyberWave does not assemble datasets from Customer Data for model development.
• We do not export Customer Data for model development, to Anthropic or anyone else.
• AI results are stored in your workspace. CyberWave stores each AI result in the Customer's workspace (the output, a short summary, and a short excerpt or label of the request of up to 300 characters) and records a short request excerpt in an append-only audit log. Some features also write AI output into workspace records, for example vendor and contract summaries and evidence review notes. AI use is metered against the plan's monthly credit allowance, and that usage is recorded.
• Content is submitted to the AI provider only to fulfil the request the user made.

How the provider itself handles the content it receives is set out in the provider's own terms, linked in the table above.

5.4 Stripe

Trials. CyberWave offers a 14-day free trial of the plan the Customer selects, Essentials or Full Platform only. No payment card is required, there is no automatic charge, and a trial does not convert to a paid plan automatically. A trial is not a paid plan and includes no fees, so starting and using a trial does not require giving payment information to this provider. Continuing after the trial means choosing a paid subscription, and Customer Data is not deleted because a trial ended.

5.5 Resend

A note on onward infrastructure. This provider delivers email through Amazon Web Services. We name that because a subprocessor list that stops at the first vendor and hides the infrastructure underneath it is less useful than one that says where the mail actually leaves from. The contractual relationship is with the named provider, and delivery is from the United States.

5.6 GoDaddy, including Microsoft 365 mail

The marketing website. cyberwave.ca is hosted by Vercel (section 5.2), not by this provider. Neither the website nor the application sets analytics, advertising or tracking cookies or loads such scripts. The Cookie Notice describes the cookies and browser storage the application does use.

5.7 A note on the links above

Each link points to the provider's own published page. Providers move pages without telling their customers, so a link may stop resolving. Where a link no longer resolves, the provider's legal or trust index is the place to start, and we would rather be told that a link is broken than have a reader assume the underlying commitment vanished with it.

6. Not subprocessors — and why each one is excluded

This section is unusual for a subprocessor page and it is deliberate. Each provider below appears somewhere in our source code or our dependency list, and none of them receives Customer Data in production. Naming them as exclusions, with the reason, shows that this list was built from the production configuration rather than from a dependency file, and it means a reader who finds one of these in our source code does not have to wonder whether we forgot it.

Two things follow from this section.

First, if any of these is later configured in production, it becomes a subprocessor at that moment, not when someone remembers to edit this page. Changing a single production setting is enough to make this document wrong. That is why section 8 treats the configuration change, not the documentation change, as the event requiring notice.

Second, the absence of an error tracker and an analytics provider is a real property of the product today, not a choice of wording. It is also fragile in exactly the way described above.

7. CyberWave's responsibility for its Subprocessors

CyberWave remains responsible to the Customer for what its Subprocessors do. Accountability does not transfer with the data, and engaging a provider does not move the obligation onto that provider: a contract allocates work, not answerability. See the Data Processing Addendum, section 8.

Each provider's own published terms are linked in section 5.

8. Change notice — how you find out before it happens

8.1 General authorisation. A Customer authorises CyberWave to engage Subprocessors, on the terms in the Data Processing Addendum, section 8. The providers engaged as at the effective date of this version are the six in section 5.

8.2 Advance notice. CyberWave will give notice at least thirty (30) days before a new Subprocessor begins processing Customer Data, by doing both of the following:

1. updating this document, including its version string and its effective date, and recording the change in the change log in section 9; and
2. writing to the Customer's Administrator and notice contacts.

The version string is what makes the second half meaningful: an email saying "the list has changed" is only useful if a reader can tell which version of the list they were relying on before.

8.3 Objection, and what it actually gets you. A Customer may object within thirty (30) days of notice, on reasonable grounds relating to the protection of personal information, by email to support@cyberwave.ca (subject: Privacy), and we will discuss it in good faith. If it is not resolved, CyberWave will either not appoint that Subprocessor for that Customer's data, or the Customer may terminate the affected Services without penalty and receive a refund of prepaid, unused fees for the terminated portion of the term. Termination on this ground creates no further liability for either party.

This is notice-and-objection, not a veto, and we would rather say so than let it be discovered later. We cannot obtain advance consent from every customer before changing a hosting region, an email relay or an AI provider, and a single non-responding customer must not be able to block a migration the whole platform needs. An objection based on commercial preference rather than data protection is not within the clause.

8.4 Urgent replacement. Where a Subprocessor must be added or replaced immediately to preserve the security or continuity of the Services, CyberWave may make the change first and give notice as soon as practicable afterwards. We will not use that provision to avoid the notice period.

9. Versioning and change log

• Versioning. Every version carries an opaque, stable version string; this one is SUBPROCESSORS_2026_09_V1. It is never reformatted and never reused, because the Data Processing Addendum refers to this document by that string.
• Every change is logged, including a removal. A provider leaving the list is as material as one joining it.

10. How this list is checked

The list rests on the production configuration, not on recollection. The checks behind it cover:

These checks are re-run whenever a subprocessor is added, removed or changed.

11. Who this list is written for, and what CyberWave is not

The Services are sold to organisations for business use. When you accept the Terms or create an account, you represent that you are of legal age to contract, that you are using the Services for business or professional purposes and not for personal, family or household purposes, and that you have authority to bind the organisation you act for. Where mandatory consumer protection or privacy law nonetheless applies to you, that law prevails over anything here that would give you less.

What CyberWave is not, relevant here because a provider list is often read as an assurance about what the platform guarantees:

• Sentinel supports readiness, governance, assessment, evidence organisation and control management. CyberWave does not certify compliance, issue audit opinions, guarantee compliance, or replace independent auditors, certification bodies or legal counsel. Framework references are informational readiness mappings. Nothing on this list is a certification of any provider, and a provider appearing here is not us vouching for its compliance posture.
• CyberWave is not an insurer or an insurance broker. We do not bind coverage and do not guarantee coverage, premium reduction, claim payment or insurer acceptance.
• We do not operate a security operations centre or provide 24/7 monitoring, and we do not provide managed detection and response, incident response retainers, penetration testing or forensics. Security incidents affecting Customer Data are addressed under the Data Processing Addendum; CyberWave does not monitor its providers' systems on your behalf.
• AI features are assistive and optional. Outputs may contain errors, must be reviewed, and do not replace professional judgement.

Questions about this list, a provider on it, or a provider you expected to find on it. Write to CyberWave's privacy contact at support@cyberwave.ca (subject: Privacy).

CyberWave Subprocessors, version SUBPROCESSORS_2026_09_V1, effective 2026-09-13. © 2026 CyberWave.