Subprocessors

Last updated: November 1, 2026

This page lists every third party that can see personal data held by Axiospec, what each one receives, and why. It is derived from the code that runs in production rather than from a template, and it is kept current with the site.

Axiospec is built by CaliTech LLC d/b/a Axiospec, a Tennessee limited liability company, 116 Agnes Rd. Ste 200, Knoxville, TN 37919, United States. Questions go to support@axiospec.com. We aim to reply within two business days.

Read this with the Privacy Policy, which explains when We are the controller of personal data and when Your own organization is.

Where the service runs

Axiospec runs in Amazon Web Services in the us-east-1 region, Northern Virginia, United States. The database, the uploaded evidence files, the application secrets and the application itself are all in that one region. The subprocessors below process data in their own locations, which for most of them means several countries.

Party	What it does for Us	Personal data it receives	Where it processes data	Transfer basis
Amazon Web Services us-east-1, United States	Hosting, the PostgreSQL database, file storage, secrets, application logs, the message queue, the content delivery network, and outbound email	All of it. Every record in Axiospec sits on AWS, and every email We send goes out through Amazon Simple Email Service. The content delivery network is a global edge network, so it terminates connections at edge locations that may be outside the United States before forwarding to us-east-1. API responses are not cached at the edge.	United States (us-east-1). Content delivery edge locations worldwide.	Data Privacy Framework
Stripe	Payment processing for paid plans	The billing email address, a workspace identifier, and the cardholder name and billing address You type into Stripe's own form. Card numbers go straight to Stripe and never reach Axiospec servers. Closing a workspace cancels the subscription. It does not delete the customer record Stripe holds. Link, a service of Stripe, sells the plan as merchant of record for a billing address in Mexico and for a buyer in India without a GSTIN. Link then holds the buyer's details under its own privacy policy, as its own controller, not as Our subprocessor.	United States, and the countries of the service providers Stripe lists at stripe.com/legal/service-providers	Data Privacy Framework
Sentry	Application error monitoring, on the website, in the app and in both mobile apps. Android app versions before 1.8.6 also send it performance traces.	Error reports with the stack trace and the page or request path. Your IP address arrives with a report Your browser or phone sends, and Sentry is set not to store it. Reports received on or before 7 October 2026 can still hold an IP address, a browser string and, from Our servers, a name or an email address, until they are deleted in early November 2026. Reports are kept for 30 days. The website sends Your internal user identifier when You are signed in, and no name or email field, though an email address can appear inside an error message or a page address. Our servers send Your internal user identifier and Your workspace identifier when You are signed in. They send no request bodies, no local variables, no performance traces and not Your IP address, and they replace email addresses with a code. From version 1.8.6 the mobile apps send no session tracking and no performance traces, first replace email addresses and any value filed under a name or email field, and have a Send crash reports switch in Settings. On an iPhone they remove the code Sentry makes from the phone's identifierForVendor. Earlier versions also report each app start, send a random installation identifier, on an iPhone a code made from the phone's identifierForVendor and, on Android, about one in five performance traces, without that scrubbing. The Privacy Policy sets this out in full.	United States (Sentry's US data region)	Data Privacy Framework
Google Firebase Cloud Messaging	Delivering push notifications to the mobile apps	The device push token, and the text of the notification. That text names an instrument and says it is due, overdue or quarantined. It does not name the person who quarantined it. From version 1.8.6 the apps do not start Firebase Cloud Messaging until You sign in. On an iPhone the message then passes to Apple Push Notification service, described below.	Any Google Cloud location, as Google lists them at cloud.google.com/about/locations	Data Privacy Framework
Google Firebase Analytics	Product analytics inside the Android app only	From Android app version 1.8.3 collection is switched off and nothing is sent. Earlier versions send app usage events such as screen views and calibrations logged until they are updated. They also send Your internal user identifier, which is set when You sign in and cleared when You sign out. The iOS app does not link this SDK and sends nothing. Since 7 October 2026 the minimum app version is 1.8.6, so an older version asks to be updated before it can be used. In October 2026 We deleted the app's Google Analytics properties.	Google data centers, as Google lists them below the table	Data Privacy Framework
Google Google Analytics 4	Website and in-product analytics on the web	Page paths, interaction events, a client identifier Google assigns to the browser, and Your IP address. Nothing is sent to Google, and no tag is requested from Google, until You accept on the cookie banner. Your IP address reaches Google only once You have accepted and the tag is loaded. Declining, or not answering, means no request is made at all. No calibration readings or instrument data are sent. Once You accept, Google Analytics may share conversion measurements with Our linked Google Ads account.	Google data centers, as Google lists them below the table	Data Privacy Framework
Google Google Identity Services	The Google sign-in button on the sign-in and sign-up pages	Google handles the sign-in step only. Your Axiospec session token is issued by Our own API and stays with Us. The button script loads from Google only when You press the Google button. Loading it discloses Your IP address to Google.	Google data centers, as Google lists them below the table	Data Privacy Framework
GitHub	Source control and the deployment pipeline	Source code and build logs. No customer data.	United States	Data Privacy Framework
Google Google Workspace	Email for Our support mailbox, support@axiospec.com, and for the owner's mailbox	What You send Us by email. Our servers also send alerts to the owner's mailbox. The in-product feedback form sends Your name, email address, workspace name and message. A new sign-up sends the name, email address and workspace name of the person signing up, with the plan they chose and how they signed in. A lead form, such as the checklist request, sends a reference and a code for the email address, not the address itself, with the form it came from and any standard chosen. When a workspace sends Us files to migrate, the alert carries the uploader's email address, the workspace name, the file names and any note. When a workspace is suspended under US export control and sanctions law, the alert carries the workspace name, its country and its Stripe customer reference. When the files a workspace has stored pass a size We watch, the alert carries the workspace name.	Google data centers, as Google lists them below the table	Data Privacy Framework
Mercury	Banking, and paying commission to referral partners	For referral partners in the United States only: the partner's name, email address, and the bank and tax details the partner enters into Mercury's own form. No customer or calibration data. A partner outside the United States is paid by international bank wire instead.	United States	None needed: no data about people outside the United States

Where Google processes data: Google lists its data centers at datacenters.google/locations. On 5 October 2026 that list named the United States, Austria, Belgium, Chile, Denmark, Finland, Germany, India, Ireland, Japan, Malaysia, the Netherlands, Norway, Singapore, Sweden, Taiwan, Thailand, the United Kingdom and Uruguay.

Transfer basis

For the data We control, a transfer to a company in the table from the European Economic Area, the United Kingdom or Switzerland rests on the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), its UK Extension (SI 2023/1028) and the Swiss-US Data Privacy Framework (Annex 1 to the Swiss Data Protection Ordinance). That is what "Data Privacy Framework" means in the table. On 5 October 2026 We looked up each company on the Data Privacy Framework List: Amazon.com, Inc., whose entry covers Amazon Web Services, Inc.; Stripe, LLC; Sentry.io, which is Functional Software, Inc.; Google LLC; and GitHub. Each was active under all three. For the data Your workspace puts into Axiospec, Our Data Processing Agreement and the Standard Contractual Clauses in it apply as well.

Services that belong to the phone

Two services that receive data when You use the mobile apps come with the phone, not from Us. They are not Our subprocessors, and We have no data protection terms with them.

Apple Push Notification service (Apple Inc.). Every iPhone app has to deliver push notifications through it. When We send an alert to an iPhone, Firebase Cloud Messaging passes it to Apple, so Apple receives the device token and the text of the alert. That text names an instrument and says it is due, overdue or quarantined, and does not name the person who quarantined it. Apple is not in the Data Privacy Framework. To stop alerts reaching Apple, switch off Push notifications in the app's Notification settings.
Your phone's speech recognition. When You press the microphone to dictate a reading, the app hands the audio to the speech service set on Your phone. On most Android phones that is Google's, and on iPhone it is Apple's. That service may send the audio to its provider to turn it into text, under the terms between You and that provider. We never receive the audio, only the text that comes back. From version 1.8.6 the app tells You this the first time You press the microphone.

Google ML Kit in older Android versions

Android app versions before 1.8.6 contain Google's ML Kit, which reads the QR code or barcode on an instrument label. It reads the code on the phone, but it also sends Google details about the device and the app and an identifier for that installation, for Google's own diagnostics and usage statistics. Google decides how it uses that data. From version 1.8.6 the Android app reads codes with the open-source ZXing decoder instead, and scanning sends nothing to Google.

Recipients that are Yours, not Ours

Three destinations receive personal data because You chose them. They are not Our subprocessors and We have no contract with them on Your behalf.

Outbound webhooks. If Your workspace configures a webhook, Axiospec posts calibration events to the address You gave Us. That payload includes the full name of the technician who performed the calibration and any free-text notes on the record. Delivery is retried for about three days. Choose that destination carefully, because once the payload arrives it is out of Our hands.
Your own identity provider. If Your workspace turns on single sign-on, the sign-in step runs against the OIDC or SAML provider You configured. Your Axiospec session token is still issued by Our own API.
Anyone You send an export to. The audit archive is Yours to generate and Yours to share. It contains the names on every calibration record in scope.

What is not here

Some absences are worth stating, because a reader will otherwise wonder.

There is no advertising vendor on the site or in the app. We run a small Google Ads campaign on the Axiospec brand name, and no ad tag, conversion pixel or remarketing tag loads on the site or in the app. The link between Google Analytics and that Google Ads account is covered in the Google Analytics 4 row above.
There is no customer support desk, no live chat tool and no session replay tool. Support runs by email.
There is no third-party email marketing platform. Marketing email goes out through Amazon Simple Email Service, the same sender as everything else.
No identity provider holds Your Axiospec session. That token is issued by Our own API.
Microsoft social sign-in is built but is switched off in production, so Microsoft receives nothing today. If that changes this page changes first.

Where the infrastructure sits, and government access requests

This section is Our statement under Article 28 of the EU Data Act (Regulation (EU) 2023/2854).

CaliTech LLC is a Tennessee company, so it is subject to United States law. All of Axiospec's own infrastructure is in AWS us-east-1, in Northern Virginia, United States. The only part outside that region is the content delivery network, whose edge locations around the world hold no customer records. The subprocessors above process data in the places the table gives.

This is how We handle a legally binding request for customer data from a government authority, in the United States or elsewhere:

We disclose data only when a valid, legally binding order requires it. We do not disclose data in answer to an informal request.
We review whether the request is lawful, in particular whether it stays within the powers of the authority that makes it. We challenge it if, after careful assessment, We conclude that there are reasonable grounds to consider it unlawful under the laws of the country of destination, applicable obligations under international law and principles of international comity. This follows Clause 15.2 of the Standard Contractual Clauses.
We disclose only the minimum the order requires.
Where the law allows it, We tell the affected customer before We disclose anything, so the customer can object.

Data is encrypted in transit and at rest, and the database accepts no connection from the public internet.

Translation Interpretation

This list of Subprocessors may have been translated if We have made it available to You on our Service. You agree that the original English text shall prevail in the case of a dispute.

Changes to this list

At least 30 days before a new subprocessor starts processing personal data that Our customers put into Axiospec, We email the administrators of every workspace and update this page. Other changes appear here when they happen. If You also want an email about those, write to support@axiospec.com and ask. Our Data Processing Agreement explains how a customer can object to a new subprocessor.

Contract status

Our Data Processing Agreement governs the personal data Our customers put into Axiospec. It is part of Our Terms and Conditions. It incorporates the EU Standard Contractual Clauses (Module Two, and Module Three for a customer that is itself a processor), the UK International Data Transfer Addendum and the changes the Swiss data protection authority requires. For that data We act only on the customer's instructions, so the GDPR applies to the customer as controller. That is the case these clauses were written for. For the data We control Ourselves the GDPR applies to Us directly, and these clauses are not used for it. CaliTech LLC is not certified under the EU-US Data Privacy Framework and offers no EU or UK data region. Contracts with the subprocessors above are the standard terms each of them publishes. Sentry's Data Processing Addendum was accepted for Our account on 5 October 2026. Google's Ads Data Processing Terms, which cover Our Google Analytics account, were accepted on 28 April 2026. The Firebase Data Processing and Security Terms are part of the Firebase Terms of Service.