Subprocessor List

1. Purpose and scope

This page enumerates third parties that process Customer Data on Intended's behalf, in accordance with the Data Processing Addendum (available at /legal/dpa) and in furtherance of GDPR Article 28, UK GDPR Article 28, CCPA/CPRA service-provider requirements, LGPD Article 32, and comparable state and international data protection laws. This Subprocessor List identifies all active subprocessors engaged by Intended, together with their purpose and location. The list is updated from time to time, and changes are notified to Customers in accordance with the procedures set forth in Section 2 below.

2. Notification mechanism and objection rights

Intended notifies Customers of subprocessor changes as follows:

• Subscription: Customers may subscribe to notifications of subprocessor changes by sending an email to dpa@intended.so with the subject line "SUBPROCESSOR NOTIFICATIONS" from an authorized account administrator.
• Notice: Intended will post changes to this page with a dated entry in the Change Log (Section 9) and send email notification to all subscribed Customers.
• Material changes: For material changes to existing subprocessors (e.g., change of subprocessor, significant change in processing scope or location), Intended provides thirty (30) days' advance written notice.
• Objection rights: Upon notice of a material change, Customer may object in writing to dpa@intended.so within twenty (20) days, with a reasonable basis for the objection. If the parties cannot agree on an alternate subprocessor or arrangement, Customer may terminate the affected Services without penalty, with a pro-rata refund of prepaid fees for the affected Services, in accordance with DPA Section 6.
• Non-material changes: Changes that do not materially expand processing scope or change location (e.g., sub-subprocessor updates, security certifications) may be posted to this page without advance notice.

3. Active subprocessors

The following subprocessors are actively engaged and may receive Customer Data in accordance with the purposes and safeguards described below.

4. AI providers

Intended engages no third-party AI provider (such as OpenAI or Anthropic) as a subprocessor. AI policy drafting and product improvement (Privacy Policy Section 4B, DPA Section 10) run on models Intended hosts in its own infrastructure, and Customer Data is not sent to any third-party AI provider for them. The only third-party AI processing happens when Customer turns on AI-assisted classification and connects its own OpenAI or Anthropic API key. That is Customer's choice: the provider processes those requests under Customer's own agreement with it, not as Intended's subprocessor. It is off by default, each tenant uses one provider at a time, and Intended never uses its own key for it. Customer may block all AI processing in Settings → Privacy & AI at any time. What is sent in that case is described at /legal/ai-subprocessors-data-flow. Intended will give at least 90 days' advance notice, with a right to object under Section 2, before any change that sends Customer Data to a new recipient (a new AI provider or any new subprocessor) or changes where it is processed or transferred (DPA Sections 10 and 16). Improvements to models and pipelines that Intended hosts itself, operating within the published Tier 0, Tier 1 and Tier 2 contribution settings, are expressly exempt.

5. Reserved subprocessors (not currently active)

The following subprocessors are integrated into Intended's codebase and available for future use, but are NOT active in production as of the Last Updated date. No Customer Data is currently forwarded to these subprocessors. Any future activation will be preceded by Customer notification in accordance with Section 2 before any Customer Data is processed.

• PostHog, Inc. — Product analytics and event collection. Status: Environment configuration disables all data forwarding; integration present in code but inactive.
• Twilio Segment / Segment.io, Inc. — Event pipeline and data warehouse routing. Status: Environment configuration disables all data forwarding; integration present in code but inactive.

6. Intended group entities

Intended, Inc. (a Delaware corporation, registered office 2261 Market Street, San Francisco, CA 94114, USA) is the primary contracting entity and acts as the data processor on behalf of Customer (the data controller).

• Future affiliates: Any future affiliates or subsidiaries of Intended that access Customer Data will be bound by intra-group data transfer agreements providing equivalent data protection obligations to those in this List and the DPA. Such additions will be notified via the mechanism in Section 2.

7. International data transfer safeguards

Intended processes Customer Data in the United States. For Customers whose operations are based in jurisdictions with legal transfer restrictions (European Economic Area, United Kingdom, Switzerland), Intended implements the following safeguards:

• European Economic Area: Intended relies on Standard Contractual Clauses (SCCs) as approved by the European Commission (Implementing Decision (EU) 2021/914), Module Two (Controller-to-Processor), incorporated by reference in the DPA Section 8.
• United Kingdom: Intended relies on the UK International Data Transfer Addendum (UK IDTA), Version B1.0, Module Two, as issued by the UK Information Commissioner's Office under Section 119A of the UK Data Protection Act 2018, supplementing the SCCs.
• Switzerland: Intended relies on SCCs as recognized under the Swiss Federal Act on Data Protection (FADP / nDSG), with modifications required by the Swiss Federal Data Protection and Information Commissioner (FDPIC).
• Supplementary measures: Encryption at rest (AES-256-GCM) and in transit (TLS 1.3), per-tenant database isolation, role-based access control, and fail-closed architecture (as described in DPA Section 5 and Appendix TOMs) provide additional safeguards against government access.
• Sub-subprocessor transfers: Subprocessors (e.g., AWS) that themselves use sub-subprocessors (e.g., AWS sub-services in other geographies) are contractually required to flow down equivalent SCCs and safeguards per DPA Section 12 (Sub-processor obligations).

8. Post-Schrems II supplementary measures

In addition to Standard Contractual Clauses and UK IDTA, Intended implements the following supplementary technical and organizational measures to address Schrems II requirements and government access risks:

• Encryption and key management: Customer Data is encrypted at rest with per-tenant AES-256-GCM keys and in transit with TLS 1.3. Separately, authority tokens are signed with per-tenant Ed25519 key pairs (RSA-4096 / ES256 selectable), whose private keys are encrypted at rest. US government authorities cannot decrypt Customer Data without Intended's active cooperation.
• Data isolation: Per-tenant database isolation and separate key material prevent aggregation of EU Customer Data with other customers' data, limiting scope of potential government access.
• Fail-closed architecture: Unresolvable authority evaluations result in denial by default, not approval or bypass, preventing over-inclusive government access through authority decisions.
• Government access notification: Intended will notify affected Customers of any legal demand (subpoena, FISA order, National Security Letter, or equivalent) requiring disclosure of Customer Data, unless Intended is legally prohibited from doing so. Notification will be sent to dpa@intended.so and to the Customer's designated security contact as soon as legally permissible.
• Transparency reporting: Intended commits to publishing an annual transparency report for calendar year 2026 and each subsequent year, detailing (in aggregate, non-identifying form): number of government access requests, jurisdiction, type of process, and whether the request was complied with or challenged.
• Objection and termination rights: Upon notification of government access demands, Customer may object to the compelled disclosure. If Intended cannot accommodate the objection (due to legal prohibition), either party may terminate the affected Services without penalty, with a pro-rata refund.
• These measures substantially reduce risk of compelled government access but do not eliminate it entirely. Customers with heightened concerns should contact dpa@intended.so to discuss further options (e.g., on-premise deployment, data residency restrictions).

9. Enterprise customizations and opt-outs

Intended supports flexible data governance for enterprise customers.

• Subprocessor restrictions: Enterprise Customers may, in their Order Form or Master Service Agreement, restrict permitted subprocessors (e.g., 'no LLM subprocessor may process this Customer's data'; 'AWS-only infrastructure'; 'no cross-border transfers'). Intended will honor such restrictions and configure systems accordingly.
• Rules-only processing is the default: Intended forwards Customer Data to no AI provider. Only if Customer turns on AI-assisted classification with its own provider key does that provider receive requests. The "Block all AI" setting prevents this regardless of other settings.
• Single-tenant and on-premise deployments: Enterprise customers may negotiate single-tenant deployments or on-premise installation (on Customer-provided infrastructure) to eliminate cloud subprocessor engagement or enforce data residency in specific regions.
• Bring-your-own-key (BYOK) arrangements: Customers may provide their own encryption keys for at-rest encryption, limiting Intended's access to plaintext data and providing Customer with key material control.
• Contact Intended's sales or legal team at dpa@intended.so or legal@intended.so to discuss enterprise customizations.

10. Change log

This Change Log tracks updates to the Subprocessor List, including new subprocessors, material changes, and status updates.

• 2026-10-29: Removed OpenAI, L.L.C. and Anthropic, PBC as conditional subprocessors. Intended engages no third-party AI provider: AI policy drafting and product improvement run on models Intended hosts in its own infrastructure. OpenAI or Anthropic receive requests only when Customer turns on AI-assisted classification with its own API key, under Customer's own agreement with that provider (Section 4). Rules-only processing is stated as the default. No subprocessor was added.
• 2026-06-18: Added Auth0 (operated by Okta, Inc.) as an active subprocessor for Operator Console authentication at login.intended.so (identity, account-linking, passkey/WebAuthn). Processing limited to email address, passkey credential identifiers, and account-linking metadata.
• 2026-04-17: Initial publication of standalone Subprocessor List page. Content migrated from DPA Section 6 inline list. No change in active subprocessor set. Replaces previous inline subprocessor disclosure in DPA.

11. Contact and support

For questions about this Subprocessor List, the DPA, data protection, and privacy:

• DPA and subprocessor questions: dpa@intended.so
• General privacy inquiries: privacy@intended.so
• EU/UK/Swiss data protection authority responses and GDPR/UK GDPR/FDPIC inquiries: eu-privacy@intended.so
• Legal and contractual matters: legal@intended.so
• EU Representative (GDPR Art. 27): Designation in progress; contact eu-privacy@intended.so until published
• UK Representative (UK GDPR Art. 27): Designation in progress; contact eu-privacy@intended.so until published
• Swiss Representative (FADP / nDSG): Designation in progress; contact eu-privacy@intended.so until published