Subprocessors

Version 1.0.0

This page covers QortexOS. It lists the subprocessors Qualsis engages to process Customer Personal Data, and it explains how we notify you when that list changes. This is the list referenced in Section 7 and Annex III of the Qualsis Data Processing Addendum (https://qualsis.com/legal/trust/dpa).

What a subprocessor is

A subprocessor is another company Qualsis engages to process Customer Personal Data on your behalf in delivering the Services. Customer Personal Data is the personal data contained in the data you and your users submit to QortexOS, as defined in the Data Processing Addendum. It does not include the contact and billing information we collect from your administrators to manage your Qualsis account and subscription, which Qualsis handles as a data controller under its Privacy Policy (https://qualsis.com/legal/privacy); user accounts inside QortexOS itself remain Customer Personal Data covered by the DPA (see the table below). Providers that touch only that account and billing information - for example, the payment processor that handles your subscription billing - are not subprocessors of Customer Personal Data and are described in the Privacy Policy instead.

This page has two parts:

The subprocessor list - the providers that process Customer Personal Data on Qualsis's behalf. The notice and objection rights described below apply to this list.
Model providers - transparency about the companies whose AI models we run. They are listed separately because, on our current approved deployment channels, they do not receive or otherwise process Customer Personal Data on our behalf and are not subprocessors.

How we notify you of changes

Advance notice. We will notify you at least 30 days in advance before engaging a new subprocessor or replacing an existing one.
Method. Notice is made by updating this page and either sending email to your designated administrator contact address or posting a notice in the Services. Keep your administrator contact details current in your account settings so notices reach you.
Right to object. You may object in writing on reasonable data protection grounds within 30 days of the notice. We will discuss any objection in good faith; if we cannot accommodate it, you may terminate the affected Services under Section 7.4 of the DPA, with a refund of prepaid fees for the unused portion of the term for the affected Services.

The full procedure is Sections 7.3 and 7.4 of the Data Processing Addendum.

Subprocessor list

Subprocessor	What it does	Customer Personal Data categories	Location of processing	Transfer mechanism
Amazon Web Services, Inc.	Cloud infrastructure: hosting, computing, storage, networking, and backup, including the Amazon Bedrock foundation-model service that runs QortexOS AI features. On Qualsis's current approved Bedrock deployment channel and approved models, the Anthropic Claude models used in the Services are operated entirely on AWS infrastructure, and the model provider does not receive or otherwise process Customer Personal Data on Qualsis's behalf (see Model providers below).	All categories processed in the Services: customer business data (finance, operations, client, workforce, vendor, and strategy records), derived analytics and benchmark outputs, tenant user account data, backups, and platform service logs.	United States, with European Union regional availability per Customer's region selection.	EU Standard Contractual Clauses (2021/914), the UK GDPR Addendum, and the Swiss Addendum, incorporated into the AWS relationship through the AWS Service Terms and the AWS Data Processing Addendum.
Databricks, Inc.	Analytics and machine-learning pipelines that produce forecasts and benchmarks. The Databricks workspace is deployed on AWS infrastructure, in Qualsis's own AWS environment.	Customer business data used in the analytics pipelines (finance, operations, client, workforce, vendor, and strategy records) and the derived forecasts and benchmark outputs.	United States (customer data plane runs in Qualsis's AWS environment; Databricks control-plane location under verification).	EU Standard Contractual Clauses (2021/914), the UK Addendum, and Swiss FADP modifications, incorporated in the Databricks Data Processing Addendum.

Each Subprocessor is engaged under written data-protection terms, including applicable international-transfer instruments.

Model providers

On Qualsis's current approved Amazon Bedrock deployment channels, the model providers named below do not receive or otherwise process Customer Personal Data on Qualsis's behalf. Accordingly, they are not Subprocessors under the DPA. The DPA's notice and objection procedure applies only to the Subprocessor List above.

Anthropic builds the Claude models that power select QortexOS AI features. Qualsis runs these models exclusively through Amazon Bedrock, AWS's managed foundation-model service, on AWS infrastructure under Qualsis's AWS agreements. On Qualsis's current approved Bedrock deployment channel and approved models, Anthropic does not receive the prompts, outputs, or logs from Qualsis's use of the models, and model inputs and outputs are not used to train the models. Because Anthropic receives no Customer Personal Data on this channel, it is a model provider, not a subprocessor; the operative subprocessor for QortexOS AI features is AWS (the Amazon Bedrock entry in the table above).

Cohere builds the Embed models used in QortexOS document-processing and semantic-retrieval features. As with the Claude models, Qualsis runs these models exclusively through Amazon Bedrock. On Qualsis's current approved Bedrock deployment channel and approved models, Cohere does not receive the prompts, outputs, or logs from Qualsis's use of the models, and model inputs and outputs are not used to train the models. Because Cohere receives no Customer Personal Data on this channel, it is a model provider, not a subprocessor.

About this page

Additions and replacements of subprocessors trigger the notice procedure above; other updates to this page (such as removals or description changes) are reflected in the Last updated date. Questions about this page or our subprocessors: Privacy Request.