Sub-processors
Version v1 · Effective 26 October 2026 · Last updated 26 October 2026
This page lists the third parties that Nomisma LLC ("Nomisma") engages to process Customer Content and other personal data in providing Smartsteps, and explains how we notify changes. Capitalised terms have the meanings given in the Terms of Service.
1. Overview
1.1 A Sub-processor is a third party that processes Customer Content, or personal data for which Nomisma is responsible, on Nomisma's behalf in order to provide the Service. Nomisma's use of Sub-processors for Customer Content is governed by the Data Processing Addendum.
1.2 Nomisma uses two Sub-processors, Amazon Web Services and Stripe, and one conditional Sub-processor, Anthropic. The Service is hosted in the AWS us-east-1 region (Virginia, United States); AI inference through Amazon Bedrock may be served from other AWS regions within the United States.
2. Current Sub-processors
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Amazon Web Services, Inc. | Hosting and compute (Amazon ECS on AWS Fargate), including the crawler; database (Amazon RDS for PostgreSQL); file and evidence storage (Amazon S3); secret storage (AWS Secrets Manager); transactional email (Amazon Simple Email Service); DNS (Amazon Route 53); logging and monitoring (Amazon CloudWatch); optical character recognition of uploaded documents (Amazon Textract); AI inference (Amazon Bedrock) | All Customer Content, including business profiles, documents, crawl evidence and Reports; account, billing-record, support and audit data; email addresses and message content of transactional email; technical log data | United States (us-east-1, Virginia) |
| Stripe, Inc. | Payment processing for one-time purchases and subscriptions; checkout and billing portal; receipts and invoices | Billing contact name and email address, company name, payment card details (collected directly by Stripe; never seen or stored by Nomisma), transaction records | United States |
Amazon Bedrock. The Service sends policy text and crawl evidence to Anthropic's Claude models through Amazon Bedrock. Amazon Bedrock does not use customer inputs or outputs to train the underlying models. Anthropic is not a Sub-processor for requests made through Amazon Bedrock.
Stripe. Stripe acts as a processor for payment processing and, for limited purposes such as fraud prevention and its own legal and regulatory obligations, as an independent controller.
3. Conditional Sub-processor
The following provider processes data only when the condition stated applies.
| Sub-processor | Purpose | Condition | Data processed | Location |
|---|---|---|---|---|
| Anthropic, PBC | AI inference (Claude models) through Anthropic's own API | Used only as a fallback provider, when Nomisma routes AI requests to Anthropic's API instead of Amazon Bedrock | Policy text, crawl evidence and the related obligation and business-profile context sent for evaluation, review, clause labelling and summaries | United States |
4. Not Sub-processors
For completeness, the following are not Sub-processors:
- Hostinger, Nomisma's domain registrar for smartsteps.ai, does not receive Customer Content or personal data of Users.
- Customer Websites and the third parties they embed. When the crawler loads a Customer Website, that website, and any third-party resources it embeds, receive the crawler's requests in the same way they would from any browser. These parties are chosen by the Customer, not by Nomisma, and do not process Customer Content on Nomisma's behalf.
- Nomisma personnel, including contractors who provide support, act under Nomisma's direction and confidentiality obligations and are not separate Sub-processors.
Nomisma does not use third-party analytics, advertising, error-reporting, customer-support or email-sending services in the Service.
5. Notice of Changes
5.1 Nomisma will give at least thirty (30) days' notice before adding or replacing a Sub-processor, by updating this page and changing the "Last updated" date at the top. For changes that materially affect how Customer Content is processed, Nomisma will also take reasonable steps to notify Users by email or in the Service.
5.2 A Customer may object to a new Sub-processor on reasonable data-protection grounds by writing to info@nomisma.ai during the notice period, as described in the Data Processing Addendum.
5.3 Where an emergency replacement is needed to keep the Service secure or available, Nomisma may make the change with shorter notice and will update this page as soon as practicable.
6. Contact
Questions about Sub-processors: info@nomisma.ai. Related documents: Data Processing Addendum, Privacy Policy, Security Overview and Vulnerability Disclosure.