This page identifies the third-party sub-processors engaged by Nomisma LLC to process Customer Data in the course of providing the Actaa Service, together with Nomisma's commitment to provide notice of changes.
01 Overview
A sub-processor is a third party engaged by Nomisma to process Customer Data in order to provide the Actaa Service. Nomisma's processing of Customer Content on the Customer's instructions, and its use of sub-processors, is governed by the Data Processing Addendum.
With the single exception of payment processing, every sub-processor set out below is an Amazon Web Services (AWS) service operated within Actaa's own AWS account in the us-east-1 region (Northern Virginia, USA). No Customer Data is transferred to any provider outside the United States.
02 Current Sub-processors
Infrastructure and platform — Amazon Web Services, Inc.
| Sub-processor | Purpose | Data categories | Location |
|---|---|---|---|
| Amazon EC2 | Application compute and hosting | Customer Data in transit and in process memory | United States (us-east-1) |
| Amazon RDS | Primary data store | All structured Customer Data | United States (us-east-1) |
| Amazon S3 | Object storage for files, attachments, exports | Customer files and binary content | United States (us-east-1) |
| Amazon CloudFront | Content delivery and TLS termination | Encrypted Customer traffic in transit | Global edge network, United States origin |
| Amazon Cognito | Authentication, MFA, and password reset | Email, credential material, MFA factors, profile attributes | United States (us-east-1) |
| Amazon Bedrock | Private AI inference | AI prompts and outputs (transient; see note below) | United States (us-east-1) |
| Amazon Simple Email Service (SES) | Outbound transactional email | Recipient email addresses, message content | United States (us-east-1) |
| Amazon Transcribe | Speech-to-text for calls and meeting notes | Call and meeting audio, resulting transcripts | United States (us-east-1) |
Nomisma also uses supporting AWS services that process no Customer Data — key and secret management, and control-plane audit logging. These are not sub-processors within the meaning of the DPA and are therefore not listed above; the protections they provide are described in Annex II of the Data Processing Addendum.
Amazon Web Services holds independent third-party certifications including SOC 1, SOC 2, SOC 3, ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, and PCI DSS. AWS acts as a processor in respect of Customer Data and is contractually bound by the AWS Data Processing Addendum and Standard Contractual Clauses. AWS's compliance and privacy documentation is available at https://aws.amazon.com/compliance/ and https://aws.amazon.com/privacy/.
Payments — Stripe, Inc.
| Sub-processor | Purpose | Data categories | Location |
|---|---|---|---|
| Stripe, Inc. | Payment processing for subscriptions, add-ons, and one-time purchases | Billing contact (name, email, billing address) and charge metadata. Full payment credentials, including card numbers, are collected and stored by Stripe; Nomisma does not store or transmit them. | United States |
Stripe is PCI-DSS Level 1 certified. Stripe acts as a processor in respect of personal data it handles for Nomisma, except for the limited processing it performs as an independent controller for fraud prevention and regulatory compliance. Stripe's privacy documentation is available at https://stripe.com/privacy.
03 Conditional Sub-processors
The following service is integrated but processes Customer Data only where the corresponding feature is enabled for a workspace. Where the feature is off, no data reaches the service.
| Sub-processor | Purpose | Enabled when | Location |
|---|---|---|---|
| Amazon Textract | Optical character recognition for uploaded documents | Document OCR is enabled for the workspace | United States (us-east-1) |
04 Marketing-Website Analytics
The Actaa marketing website (actaa.ai) uses a first-party analytics counter that sets no cookies, honors Do Not Track (DNT) and Global Privacy Control (GPC) signals, employs a daily-rotating salted visitor hash, and does not store raw IP addresses.
The website additionally contains a consent-gated integration for Google Analytics 4 (provided by Google LLC, United States). That integration is not currently active: no measurement identifier is configured, and no analytics data is transmitted to Google. Were it to be activated, it would load only where a visitor consents through the website's cookie banner, and Google LLC would then act as a sub-processor in respect of website analytics only. This section concerns the marketing website alone and is separate from the Actaa platform sub-processors listed above.
05 What We Do Not Use
To assist Customer due diligence, the following are not sub-processors of the Actaa platform. Nomisma does not currently use:
- third-party analytics or behaviour-tracking SDKs within the platform (no Google Analytics, Mixpanel, Amplitude, Heap, Segment, Hotjar, Pendo, or FullStory) — see section 4 for the separate position on the marketing website;
- third-party error or crash reporting (no Sentry, Datadog, Rollbar, or Bugsnag);
- customer support tooling that receives Customer Data (no Intercom, Zendesk, or Help Scout);
- third-party email-sending platforms (no Resend, SendGrid, Postmark, Mailgun, or Twilio SendGrid; outbound email is sent via Amazon SES);
- third-party AI or large-language-model APIs other than Amazon Bedrock (no direct OpenAI, Anthropic, or Google AI endpoints);
- any provider outside the United States that receives Customer Data.
Should any of the above change, Nomisma will publish an update on this page in accordance with section 6.
06 Notification of Changes
Nomisma shall provide at least thirty (30) days' advance notice of any intended change concerning the addition or replacement of a sub-processor, so as to afford Customers the opportunity to object on reasonable data-protection grounds, as set out in the Data Processing Addendum. Notice is given by updating this page and, for material changes, by email to the workspace Administrator.
07 Affiliates
Nomisma may rely on its corporate affiliates to provide internal business support functions such as engineering, security, and finance. Affiliates are bound by confidentiality obligations and by intercompany data-sharing terms consistent with the Data Processing Addendum.
08 Contact
Questions about sub-processors may be directed to info@actaa.ai.