Operational record
Subprocessor Register
Every third party that processes Rex Black or client data.
Subprocessor Register
Rex Black engages the following third parties to deliver its
services. Each entry lists what is processed, where it lives, and the
legal basis. The latest version of this register is published at
https://rexblack.com/trust/subprocessors.
Material additions are notified to clients by email at least 30 days in advance, unless their contract specifies a different cadence.
Active subprocessors
| Vendor | Service | Data processed | Region | Legal instrument | Tier | Onboarded |
|---|---|---|---|---|---|---|
| Amazon Web Services | Cloud hosting (compute/storage/DB) | All Rex Black + client data | US-East, US-West | AWS DPA + SCCs | T1 | 2024-01-01 |
| Google LLC (Workspace) | Business email, docs, calendar | Rex Black internal comms + business records | US / Global | Google Workspace DPA + SCCs | T2 | 2024-01-01 |
| Stripe, Inc. | Billing, invoicing, payments | Customer billing, payment methods (tokenized) | US | Stripe DPA + SCCs | T1 | 2024-03-01 |
| GitHub, Inc. (Microsoft) | Source control, CI/CD | Source code, CI logs | US | GitHub DPA + SCCs | T2 | 2024-01-01 |
| ClickUp / Mango Inc. | Project task management (where used) | Project metadata, client contact details | US | ClickUp DPA | T2 | 2024-06-01 |
| Asana, Inc. | Project task management (where used) | Project metadata, client contact details | US | Asana DPA | T2 | 2025-02-01 |
| OpenAI, L.L.C. | AI model API (engineering tooling) | Prompts, code (Internal only; Confidential only under Enterprise tier) | US | OpenAI DPA + no-training terms | T2 | 2024-08-01 |
| Anthropic, PBC | AI model API (engineering tooling) | Prompts (Internal only; Confidential only under Enterprise tier) | US | Anthropic DPA | T2 | 2025-01-01 |
| SendGrid / Twilio (where used) | Transactional email (backup to SES) | Email metadata, delivery events | US | Twilio DPA + SCCs | T2 | 2025-03-01 |
| Slack Technologies (Salesforce) | Team messaging (where used) | Internal comms | US | Slack DPA + SCCs | T2 | 2024-05-01 |
All vendors above have current SOC 2 Type II (or ISO 27001)
attestations on file. Copies for audit are available on request from
compliance@rexblack.com.
Sending-domain infrastructure
Rex Black uses Amazon SES for transactional email
(no-reply@rexblack.com, billing@, security@, etc.).
Historic subprocessors
None retired yet.
Change log
| Date | Change | Approved by |
|---|---|---|
| 2026-04-17 | Initial published register | CEO |