Sub-processors
Third-party sub-processors engaged by MeaningfulCX GmbH
This document lists all third-party sub-processors that MeaningfulCX GmbH ("Meaningful") engages to process Customer Data in the course of providing our Services. This list is maintained in accordance with our Data Processing Agreement.
Core sub-processors
These sub-processors are always active and essential to providing the Services.
1. Amazon Web Services (AWS)
Entity: Amazon Web Services EMEA SARL
Service: Cloud infrastructure, data storage, serverless compute, AI model hosting (Bedrock — Anthropic Claude)
Data processed: All Customer Data including research participant responses, uploaded files, analysis outputs, and backups
Location: EU (Frankfurt, Germany — eu-central-1)
Data residency: All data stored and processed in eu-central-1. No cross-region replication to non-EU regions.
AI commitment: Customer Data is not used to train or improve AI models. AWS Bedrock processes data in real-time with no retention beyond transient processing.
Certifications: ISO 27001, SOC 2 Type II, SOC 3, PCI DSS
2. Microsoft Azure
Entity: Microsoft Ireland Operations Limited
Service: AI processing (Azure OpenAI Service — GPT models), real-time voice-to-text for AI-moderated interviews (Azure Speech Services). Voice audio is processed in real-time and not stored; only the resulting text transcript is retained.
Data processed: Interview and survey responses (text). Voice audio is streamed in real-time for transcription and is not stored.
Location: EU (Sweden Central)
Data residency: All data processed in Sweden Central region. Azure OpenAI configured with EU data zone to prevent cross-border transfers.
AI commitment: Customer Data is not used to train or improve Azure OpenAI models per Microsoft's commitment. Data is not shared with OpenAI.
Certifications: ISO 27001, SOC 2 Type II
DPA: Microsoft Products and Services Data Protection Addendum
3. PostHog
Entity: PostHog, Inc.
Service: Product analytics and error tracking
Data processed: Platform usage data (page views, feature usage, anonymised user identifiers). No research participant data is sent to PostHog.
Location: EU (EU-hosted cloud instance — all data stored and processed within the EU)
Data residency: We use PostHog's EU Cloud deployment. No analytics data leaves the EU.
Certifications: SOC 2 Type II
DPA: PostHog Data Processing Agreement in place
4. Clerk
Entity: Clerk, Inc.
Service: User authentication and identity management for the platform
Data processed: Platform user accounts (researcher names, emails, organisation membership, authentication logs). Not research participants.
Location: United States
Transfer mechanism: EU–US Data Privacy Framework (DPF) adequacy decision, with Standard Contractual Clauses (SCCs) as fallback
Certifications: SOC 2 Type II
DPA: Clerk Data Processing Agreement (DPF + SCCs)
Optional feature sub-processors
These sub-processors are engaged only when Customer explicitly enables optional features. If you have not enabled these features, your data has not been processed by these providers.
5. Google (Gemini)
Entity: Google LLC
Service: AI model inference (Gemini) via Google AI Studio for the AI Perception research feature
Data processed: Research questions and optional context only. No participant personal data is sent — functionally equivalent to a search query.
Location: Google data centres
AI commitment: Data not used for model training per Google AI Studio terms. Real-time processing with no long-term data retention.
Customer control: Only activated when Customer explicitly enables the AI Perception feature. Not used for standard interview or survey analysis.
6. Perplexity AI
Entity: Perplexity AI, Inc.
Service: Search-augmented AI for the AI Perception feature
Data processed: Research questions and search queries only. No participant personal data is sent.
Location: United States
Transfer mechanism: Standard Contractual Clauses (SCCs) in place
AI commitment: Enterprise API tier with no-training commitment. Real-time processing with no persistent storage.
Customer control: Only activated when Customer explicitly enables the AI Perception feature.
Social listening
Social listening is provided as a managed service, separate from the self-service platform. Data collection occurs in a separate sandbox environment (not the main platform infrastructure), and only final aggregated and anonymised results are uploaded to the Customer's workspace.
For social listening projects, Meaningful may engage project-specific data collection tools (such as social media platform APIs). The specific tools used will be disclosed in the project proposal and require Customer approval before engagement.
Sub-processor change notification
Meaningful provides at least 30 days' advance written notice before engaging a new sub-processor or making material changes to an existing sub-processor's role. Notification is sent via email to the Customer's registered account email address.
If Customer objects to a new sub-processor on reasonable data protection grounds, Customer may notify Meaningful in writing within 30 days of receiving notice. The parties will work together in good faith to find a commercially reasonable solution. If no solution can be found, Customer may terminate the affected Services without penalty.
Summary
| Sub-processor | Purpose | Location | Type |
|---|---|---|---|
| Amazon Web Services | Infrastructure, storage, AI (Claude) | EU (Frankfurt) | Core |
| Microsoft Azure | AI (GPT), speech, transcription | EU (Sweden) | Core |
| PostHog | Product analytics | EU | Core |
| Clerk | Authentication | US (DPF) | Core |
| Google (Gemini) | AI Perception feature | Google data centres | Optional |
| Perplexity AI | AI Perception feature | US (SCCs) | Optional |
Version history
| Date | Change |
|---|---|
| April 2026 | Initial publication. Added Clerk, Google Gemini, Perplexity AI, and Parallel AI. Clarified social listening as managed service. |
| April 2026 | Removed Parallel AI. Secondary Research now uses Azure OpenAI exclusively. Updated Perplexity AI scope to AI Perception only. |
Last updated: April 2026
For questions about sub-processors, please contact us at contact@meaningful.app