This page lists every third-party processor that may handle Customer Personal Data under GymAxis AI's Data Processing Agreement.
30-day change notice
GymAxis will provide customers at least 30 days' notice before adding, replacing or materially changing a sub-processor. Customers may object in writing; if the objection cannot be resolved within 30 days the customer may terminate the affected workload without penalty. Subscribe at dpo@gymaxisai.com.
Card processing, subscription billing, Stripe Connect for engineer payouts
UK / Ireland / US
SCCs · UK IDTA · Stripe DPA
4. AI / LLM providers
GymAxis uses Large Language Models for the AI Assistant, SEO Autopilot, Tender drafting and CRM insights. Provider selection happens via the Emergent LLM Key proxy.
Sub-processor
Purpose
Region
Transfer mechanism
OpenAI
Text (GPT-4o / GPT-5.2), image (GPT Image 1), Whisper STT
US
SCCs · OpenAI DPA · "no training on API data"
Anthropic
Text (Claude Sonnet 4.5)
US / EU
SCCs · Anthropic DPA
Google (Gemini)
Text, image (Nano Banana)
US / EU
SCCs · Google DPA
Operator obligation: Do not paste raw special-category data (health, biometric, criminal) into AI prompts. Use the redact-before-prompt pattern documented in the Help Centre.
5. Observability & analytics
Sub-processor
Purpose
Region
Transfer mechanism
Sentry(enabled when SENTRY_DSN is set)
Server + client error tracking (no PII)
US / EU options
SCCs · UK IDTA
PostHog(planned)
Product analytics, anonymous event metadata
EU-Frankfurt
SCCs
6. Integrations enabled per-tenant (opt-in, not default)
These sub-processors only receive data if the customer explicitly enables the integration in their workspace:
Sub-processor
Triggered by
Data categories
Microsoft (Outlook Calendar)
Tenant connects Microsoft 365 account
Calendar events, meeting attendees
DocuSign
Tenant sends a CRM quote for signature
Recipient name + email, document content
Sage 200
Tenant maps Sage company in /master-admin/integrations
Invoice + customer ledger data
Sicon (Service Manager)
Tenant connects Sicon credentials
Equipment service history
Google Calendar(via Emergent Auth)
Tenant connects Google account
Calendar events
Meta (Instagram Graph API)(planned)
Tenant connects IG Business account
Post content + media
7. Audit & legal
GymAxis itself acts as data processor when handling Customer Personal Data on behalf of a Tenant. Where Tenant Personal Data ends up in our paid sub-processors above, we have a written DPA in place with each. A list of executed DPAs is available on request: dpo@gymaxisai.com.
