Skip to content
Privacy · LGPD

Subprocessors

List updated on October 27, 2026

This page lists the companies that process personal data on AutoController’s behalf: for what purpose, where, and under which international-transfer basis. Where the transfer instrument required by the ANPD is still missing, the row reads “Being regularized”: that regularization is under way as the treatment of risk R-09 in our information-security risk register, owned by the Data Protection Officer, Anderson Souza dos Santos. Vendors that receive no personal data, or that process it as independent controllers, are not on this list.

Subprocessors
VendorServicePurposeData categoriesProcessing locationsSeatTransfer basisMethodListed since
SupabaseAuthorizedDatabase and authenticationStore the platform database and authenticate users.
  • Identification and contact (name, e-mail, phone)
  • Financial and accounting data
  • Access credentials
  • Technical access data (IP address, usage logs)
  • Message content
  • Brazil
Being confirmedBeing regularized — the transfer instrument required by the ANPD has not yet been formalized with this vendor.Data hosting
VercelAuthorizedApplication hostingHost and serve the website and the platform.
  • Identification and contact (name, e-mail, phone)
  • Financial and accounting data
  • Access credentials
  • Technical access data (IP address, usage logs)
  • Message content
  • Brazil
  • Global (multiple countries)
Being confirmedBeing regularized — the transfer instrument required by the ANPD has not yet been formalized with this vendor.Data hosting
AnthropicAuthorizedAI modelGenerate the AI experts’ analyses and answers, including the website demo.
  • Message content
  • Identification and contact (name, e-mail, phone)
  • United States
Being confirmedBeing regularized — the transfer instrument required by the ANPD has not yet been formalized with this vendor.Sent via API
OpenAIAuthorizedAI modelGenerate the AI experts’ analyses and answers as an alternative model provider.
  • Message content
  • Identification and contact (name, e-mail, phone)
  • United States
Being confirmedBeing regularized — the transfer instrument required by the ANPD has not yet been formalized with this vendor.Sent via API
Google (Gemini API)AuthorizedAI modelGenerate the AI experts’ analyses and answers as an alternative model provider.
  • Message content
  • Identification and contact (name, e-mail, phone)
  • Global (multiple countries)
Being confirmedBeing regularized — the transfer instrument required by the ANPD has not yet been formalized with this vendor.Sent via API
Google WorkspaceAuthorizedCorporate e-mailReceive and answer messages sent to the DPO, sales contacts and data-subject requests.
  • Identification and contact (name, e-mail, phone)
  • Message content
  • Global (multiple countries)
Being confirmedBeing regularized — the transfer instrument required by the ANPD has not yet been formalized with this vendor.E-mail mailbox
ResendAuthorizedTransactional e-mailSend the authentication e-mails — sign-up confirmation, invitation, sign-in link and password reset — until the migration to Amazon SES is complete.
  • Identification and contact (name, e-mail, phone)
  • Message content
  • United States
  • Region not confirmed by the vendor
Being confirmedBeing regularized — the transfer instrument required by the ANPD has not yet been formalized with this vendor.Sent via API
UpstashAuthorizedRequest rate limitingRate-limit requests to protect the website and the platform from abuse.
  • Identification and contact (name, e-mail, phone)
  • Technical access data (IP address, usage logs)
  • Region not confirmed by the vendor
Being confirmedBeing regularized — the transfer instrument required by the ANPD has not yet been formalized with this vendor.Sent via API
AWSAuthorizedData ingestion gatewayReceive the data sent by the integration agent installed in the client company’s environment.
  • Financial and accounting data
  • Identification and contact (name, e-mail, phone)
  • Brazil
Being confirmedBeing regularized — the transfer instrument required by the ANPD has not yet been formalized with this vendor.Data hosting
Amazon SESAuthorizedTransactional e-mailSend the platform’s e-mails — authentication e-mails, deadline notifications and onboarding reminders — and keep the suppression list in São Paulo: an address that bounces an e-mail or marks it as spam stays on it, so that no further e-mail is sent to it.
  • Identification and contact (name, e-mail, phone)
  • Message content
  • Brazil
Being confirmedBeing regularized — the transfer instrument required by the ANPD has not yet been formalized with this vendor.Sent via API

International data transfers

  1. Method, duration and purpose: how the data reaches each vendor and what it is used for are in the Method and Purpose columns of the table above, vendor by vendor. How long each vendor keeps the data will be shown in a Retention column as the transfer to that vendor is regularized; while a vendor’s row reads “Being regularized”, that period is not yet published.
  2. Destination countries: the countries where each vendor processes the data are in the Processing locations column. When a vendor has not confirmed the region, the table says so instead of assuming Brazil.
  3. Controllers and contacts: for the data of website visitors, sales contacts and account holders, the controller is Asantis Tecnologia Ltda, which operates AutoController, and the contact is the Data Protection Officer, Anderson Souza dos Santos, at dpo@autocontroller.ai. For the data a client company enters into the platform, the client company is the controller and Asantis Tecnologia Ltda acts as processor; the contact is the data protection officer the client company has appointed.
  4. Shared use and purpose: AutoController shares data with each vendor only for the purpose shown in the table, and does not sell personal data.
  5. Responsibilities and security measures: AutoController is accountable for the processing and for choosing its vendors. Data travels and is stored encrypted, isolated per client company, and events are kept in an audit trail. Before anything is sent to an AI model, the CPF is replaced by a token and the date of birth by an age range; name, e-mail and phone number are sent to the model unmasked, because the experts need them to identify people.
  6. Your rights: you may request confirmation of processing, access, correction, portability, deletion and information about sharing (article 18 of the LGPD) through the DPO channel, dpo@autocontroller.ai; for data entered by a client company, you may also make the request directly to that company, as the controller. You also have the right to petition the Brazilian National Data Protection Authority (ANPD).

Vendors’ own subprocessors: each vendor may engage its own subprocessors. Where a vendor publishes that list, the link to it appears below.

Full clauses: upon request to the DPO, at dpo@autocontroller.ai, we deliver the full contractual clauses governing each international transfer within 15 days.