QUOME CLOUD SUBPROCESSOR LIST
Last Updated: November 9, 2026
Approved: November 5, 2026, 12:32 AM PST
Document ID: QUOME-LEGAL-SUBPROCESSORS-CLOUD-001
Version: 1.2
Review Cycle: Quarterly
1. Purpose
This list identifies the subprocessors that process customer data on behalf of Quome, Inc. in delivering Quome Cloud, as required by GDPR Article 28 and by our Privacy Notice. A subprocessor is any third-party entity that processes personal data or Customer Content on Quome's behalf in order to deliver Quome Cloud.
Quome Cloud runs on infrastructure that Quome owns and operates. The subprocessors below handle the edges of the service: email, the public network entry point, payments, and certificates.
2. Notification Process
Quome will notify customers at least 30 days before adding or replacing a subprocessor. Notification will be sent by email to the owners of each organization on record and posted at https://quome.cloud/legal/subprocessors.
Customers may object to a new or replacement subprocessor within 15 days of receiving notification by emailing legal@quome.com. If Quome is unable to reasonably accommodate the objection, the customer may terminate their agreement and delete their organization in accordance with the Terms of Service.
3. Quome-Operated Infrastructure (First Party)
Not a subprocessor, listed for clarity.
| Operator | Purpose | Data Processed | Location |
|---|---|---|---|
| Quome, Inc. | Compute, storage, network, identity, secrets, and the control plane for Quome Cloud | All Customer Content, account data, metering, and audit records | United States |
Where a site is housed in a leased facility, the facility provider supplies power, cooling, space, and physical security only. It has no logical access to Quome systems, and every disk is encrypted at rest.
4. Infrastructure Subprocessors
These subprocessors support network delivery.
| Subprocessor | Purpose | Data Processed | Location | Certifications |
|---|---|---|---|---|
| The Constant Company, LLC (Vultr) | Network relays that route encrypted traffic to Quome. Relays cannot read its contents. | Client IP addresses, requested hostnames, encrypted traffic in transit | United States | SOC 2, ISO 27001 |
| Namecheap, Inc. | Domain registrar and DNS | DNS queries (resolver IP addresses); no customer data | United States | — |
| Internet Security Research Group (Let's Encrypt) | TLS certificates | Domain names attached to your apps | United States | — |
5. Application Subprocessors
These subprocessors provide features within the platform.
| Subprocessor | Purpose | Data Processed | Location | Certifications |
|---|---|---|---|---|
| Resend, Inc. | Transactional email and receipt of inbound email for addresses you create in the Services | Email addresses, names, message subjects and bodies, and, for inbound addresses, the full received message and attachments | United States | SOC 2 |
| Stripe, Inc. | Payment processing for cards on file, invoices, and credit purchases. Planned: Quome Cloud bills against a prepaid credit balance today and does not yet send any data to Stripe; Stripe becomes active when card entry ships, and this row will be updated. | Email, billing address, payment tokens, charge history | United States | PCI DSS Level 1, SOC 2 |
6. Third Parties You Choose (Not Subprocessors)
These vendors receive data only because you link your own account with them and run their tools inside your sandboxes. Data flows directly from your sandbox to the vendor under your account and their terms; Quome is not a party to that processing and holds no account with them on your behalf.
| Vendor | How It Is Used | What It Receives |
|---|---|---|
| Anthropic, PBC | Claude Code in sandboxes, using your Anthropic account | Prompts, files, and code the agent sends |
| OpenAI, L.L.C. | Codex in sandboxes, using your OpenAI account | Prompts, files, and code the agent sends |
| Google LLC | Antigravity in sandboxes, using your Google account; optionally, Google as a sign-in provider | Prompts, files, and code the agent sends; for sign-in, your name and email |
| GitHub, Inc. | Repositories you connect for deploys | Repository contents you authorize |
7. Document Control
| Field | Value |
|---|---|
| Version | 1.2 |
| Author | Quome Security Team |
| Approved | November 5, 2026, 12:32 AM PST |
| Next Review | February 5, 2027 |
| Classification | Public |