Subprocessor List

Providing Behemoth requires relying on third parties: someone has to host the servers, someone has to process the payments, and someone has to deliver the system’s email. Those third parties are our subprocessors, and they process personal data on behalf of Nephilim Systems LLC, under the obligations set out in the Data Processing Addendum.

This list is complete: we engage no subprocessor that does not appear here. For each one we state the name, the service it provides, the type of data it reaches, and the place where it processes that data.

Two of the entries correspond to the same provider, Amazon Web Services. They are declared separately, and not as a single entry, because they are different services and the data each one reaches is different as well: the infrastructure reaches all of the data in the service, whereas transactional email reaches only the recipient’s address and the message sent.

Each subprocessor is contractually bound to process the data only on our instructions, to maintain confidentiality, and to apply security measures equivalent to our own. Nephilim remains liable to the Customer for the performance of those obligations.

Any addition or replacement is notified to the Customer at least thirty calendar days in advance, by updating this page and by a notice within the system. During that period the Customer may object to the change on reasonable data protection grounds and, if the objection cannot be resolved, terminate the subscription without penalty, in accordance with the Data Processing Addendum.

Service provided: the product’s infrastructure. It supplies the compute on which the application runs, the database where the records reside, and the storage of the files the Customer uploads, such as product images and expense receipts.

Type of data reached: all of the data in the service. It covers both the Customer’s account data and the data the Customer uploads about its own customers, suppliers, and employees.

Place of processing: United States of America, region us-east-1.

Service provided: payment processing. It charges the Customer’s subscription to Behemoth and, where the Customer enables that feature, also processes the payments the Customer collects from its own customers. In that second case the Customer maintains its own contractual relationship with the provider and is the merchant of record for the transaction.

Type of data reached: billing and payment data. It covers the identification of the holder of the payment method, the contact email address, and the amount and status of each charge. Full card details are entered directly into the provider’s environment and never pass through or are stored in Nephilim’s systems.

Place of processing: United States of America.

Service provided: delivery of the emails the system generates, such as account activation, operational notices, and password recovery. It is carried out by means of Amazon Simple Email Service (Amazon SES). It is not used for commercial communications or for marketing campaigns.

Type of data reached: the recipient’s email address and the content of the message sent.

Place of processing: United States of America.

This list corresponds to version 2026-09-01 of the legal package, which is also its effective date.

Any question about the subprocessors, and any objection to an announced change, is directed to the contact channel published in the footer of this site.