Version 1.0 · Effective October 29, 2026 · Last updated October 29, 2026
This Subprocessor List names the third parties ("Subprocessors") that Sapiura Systems LLC uses to Process Client Personal Information. Client Personal Information is personal information that we handle for insurance agencies as their service provider, such as quote-form submissions from agency websites. This list forms part of our Data Processing Addendum at sapiura.com/dpa ("DPA"), which is part of our Client Services & Subscription Agreement (sapiura.com/client-agreement). Terms in capitals have the meanings given in the DPA.
How changes work. We give at least 30 days' notice before a new Subprocessor begins Processing Client Personal Information. We give it by updating this page and by emailing each client's primary contact. Clients may object as DPA Section 7.5 describes. In an emergency, for example if a provider fails or is compromised, we may replace a Subprocessor sooner and will give notice within 5 Business Days (DPA Section 7.4). Every Subprocessor is bound by written terms that protect the data, and we remain responsible for it.
Where data is stored. We store Client Personal Information at rest in our own systems only in the United States (DPA Section 12). Some providers, such as Cloudflare's network and the AI model providers, may route or process data transiently outside the United States (DPA Section 12.2). Quote-form submissions are never sent to AI providers.
A. Subprocessors that Process Client Personal Information
| Subprocessor | Purpose | Client Personal Information involved | Location of storage / processing | Privacy & data terms |
|---|---|---|---|---|
| Cloudflare, Inc. | Security, firewall, DDoS protection, bot detection (Turnstile) and content delivery for Sapiura's form-forwarding endpoints | Form-submission data in transit; IP address, user agent and anti-bot signals | United States (storage); global network (in transit) | cloudflare.com/privacypolicy · cloudflare.com/cloudflare-customer-dpa · cloudflare.com/turnstile-privacy-policy |
| Amazon Web Services, Inc. | Servers that run Sapiura's form-forwarding service and AI Assistant (managed with Coolify, self-hosted open-source software) | Form submissions in processing, the 30-day backup, security logs, approver records | United States (US East, N. Virginia) | aws.amazon.com/privacy · aws.amazon.com/service-terms |
| Amazon Web Services, Inc. (Sapiura's own database on the same servers) | Encrypted database for the 30-day form-submission backup, AI Assistant change history and approver records | Form-submission backup (30 days); approver names and work emails; change and approval records | United States (US East, N. Virginia) | aws.amazon.com/privacy · aws.amazon.com/service-terms |
| Amazon Web Services, Inc. (Amazon SES) | Delivering form-submission emails and producer alerts to the agency's inbox; AI Assistant preview and approval emails | Form-submission contents (in delivery emails); approver emails | United States | aws.amazon.com/privacy · aws.amazon.com/service-terms |
| GitHub, Inc. (in the client's own account) | Storing the website's source code, which contains team names, bios, photos and license numbers that the agency approves for publication | Client personnel information published on the site. No form submissions. | United States | docs.github.com/site-policy/privacy-policies/github-general-privacy-statement · github.com/customer-terms |
| OpenRouter, Inc. | Routing AI Assistant requests to AI models. Configured so requests go only to the model providers on this list, with prompt logging and training turned off, and zero-data-retention routing where it is available | AI Assistant request text and the website content involved, which may include published team information. Never form-submission contents. | United States (OpenRouter); model providers may process transiently elsewhere | openrouter.ai/privacy · openrouter.ai/terms |
| OpenAI, L.L.C. (API, reached through OpenRouter or directly) | AI model for AI Assistant drafting; Shortlist Score questions (public business details only) | As for OpenRouter. API data is not used for training by default; abuse-monitoring retention is up to 30 days unless zero data retention applies. Web search results may be kept under OpenAI's own terms. | United States (may process elsewhere) | openai.com/policies/privacy-policy · openai.com/policies/data-processing-addendum |
| Perplexity AI, Inc. (API, reached through OpenRouter or directly) | Shortlist Score questions (public business details only) | No Client Personal Information is intended. Public business details only. Listed for transparency. | United States (may process elsewhere) | perplexity.ai/hub/legal/privacy-policy · Perplexity API terms and DPA |
| Cloudflare, Inc. (Cloudflare Web Analytics) | Cookie-free, aggregate visit counts on agency websites and for AI Assistant reports | Technical data (such as IP address and user agent) processed transiently and stored only in truncated, hashed or aggregate form to produce counts. No cookies, no cross-site tracking, no visitor profiles. | United States (storage); global network (in transit) | cloudflare.com/privacypolicy · cloudflare.com/cloudflare-customer-dpa |
B. Vendor integrations the agency chooses (not Sapiura Subprocessors)
When an agency tells us to deliver form submissions to its own CRM, management system or quoting vendor, the vendor receives the data as the agency's own service provider, under the agency's contract with that vendor. Examples are AgencyZoom, HubSpot, GloveBox, Better Agency, Momentum AMP (NowCerts) and EZLynx. These vendors are not Sapiura Subprocessors. The same applies to the agency's own Cloudflare account, domain registrar and listing accounts (Google Business Profile, Bing Places, Apple Business Connect, Yelp), which stay in the agency's name.
C. Service providers for Sapiura's own data (for transparency)
These providers handle personal information that Sapiura collects for its own purposes, such as orders, billing, scheduling and contracts. Our Privacy Policy (sapiura.com/privacy) covers that information. These providers do not Process Client Personal Information.
| Provider | Purpose | Location | Privacy terms |
|---|---|---|---|
| Stripe, Inc. | Checkout, card and ACH payments, invoices, billing portal, fraud prevention | United States (and Stripe's global infrastructure) | stripe.com/privacy · stripe.com/legal/dpa |
| Google LLC (Google Workspace / Calendar appointment booking) | Scheduling calls with Sapiura; Sapiura's own business email (not used to deliver agency form submissions) | United States | policies.google.com/privacy · workspace.google.com/terms/dpa_terms.html |
Questions or objections: info@sapiura.com, subject line "Subprocessors" Sapiura Systems LLC · 7345 W Sand Lake Rd, Ste 210, Office 3330, Orlando, FL 32819
Change log
| Date | Change |
|---|---|
| October 29, 2026 | Initial list published. |