Apex engages the following sub-processors to provide the Service. Integration vendors process Customer Data only when you connect that integration. The DPA describes notice and objection rights. Apex will post additions here at least 30 days before they go live.

Sub-processor	Purpose	Location	Policy
Amazon Web Services, Inc.	Infrastructure, DynamoDB, S3, ECS, CloudFront, CloudWatch, KMS	United States (us-east-1)	Privacy
Amazon SES	Transactional and marketing email delivery	United States	Privacy
Amazon Cognito	Authentication for merchant and partner accounts	United States	Privacy
Amazon Bedrock	Inference for advisor, generation, and similar AI features	United States	Privacy
Stripe, Inc.	Billing and partner payouts via Stripe Connect	United States	Privacy
Meta Platforms, Inc.	Only if you connect Meta Ads: read performance; send CAPI or audiences you enable	United States	Privacy
Google LLC	Only if you connect Google Ads or YouTube: read performance; send conversions or Customer Match you enable	United States	Privacy
LinkedIn Corporation	Only if you connect LinkedIn Ads: read performance; send conversions you enable	United States	Privacy
HubSpot, Inc.	Only if you connect HubSpot: read and write the CRM objects you enable	United States	Privacy
Shopify Inc.	Only if you install the Shopify app: read orders, customers, and catalog you authorize	Canada / United States	Privacy
ByteDance Ltd. (TikTok)	Only if a partner connects TikTok: read the public profile scopes they grant	United States / Singapore	Privacy

Questions: privacy@apex.inc.

Sub-processors