Subprocessors

The following entities process customer personal data on our behalf. Each is bound by written terms no less protective than our DPA, with SCCs or the UK IDTA where required.

• Supabase (managed Postgres, authentication, object storage) — hosting of case files, evidence records, audit chain and account data. Primary region: European Union (Frankfurt) by default; US and Asia-Pacific regions available on enterprise tenancies.
• Cloudflare (edge delivery, TLS termination, DDoS and WAF) — transient processing of request metadata and IP addresses. Global edge, with data at rest confined to the tenancy region.
• Google LLC / Google Cloud (Gemini model inference via the platform AI gateway) — transcription of cockpit, ATC and interview audio, and extraction from uploaded documents. Content is not retained by the provider for training. United States and EU inference regions.
• Microsoft Corporation (Entra ID federated sign-in, where the customer enables it) — authentication assertions only; no case content.
• Email delivery provider — transactional messages: verification, password recovery, security alerts, invoices. No case content is placed in email bodies.
• Payment processor (enterprise billing) — billing contact details and payment instrument data, processed as an independent controller under PCI DSS. No case content.
• Error and performance monitoring — stack traces, request identifiers and environment metadata, with content redaction applied before transmission.

Oluwaseyi Aerospace LLC personnel and contracted engineering staff located in the United States and Nigeria may access production systems under least-privilege, just-in-time controls. Access to case content is exceptional, requires a support request or a security incident, and is written to the customer-visible audit chain.

• No advertising, marketing-analytics or data-broker subprocessor receives any case data or account data.
• No subprocessor is permitted to use customer content to train general-purpose models.
• No case content is copied into third-party productivity, chat or ticketing tools by our staff.

We give at least thirty (30) days' notice before adding or replacing a subprocessor, by email to the customer's designated privacy contact and by update to this page. Subscribe by writing to privacy@seyaero.com.

You may object on reasonable data protection grounds within the notice period. We will work in good faith to offer an alternative configuration; if none is available you may terminate the affected service without penalty and receive a pro-rata refund of prepaid fees.

In an emergency — for example, replacing a subprocessor that has suffered a security compromise — we may act immediately and notify without delay.

Enterprise customers may pin all case data at rest to the European Union, the United States, or an Asia-Pacific region. Residency is set at tenancy creation and recorded in the order form. Model inference for AI features is routed to an inference region consistent with that election where the provider offers one; where it does not, the feature can be disabled tenancy-wide.