Legal
Subprocessors
Effective 2026-05-14 · Incorporated by reference into the Data Processing Addendum.
Slingshot LLC engages the following third-party subprocessors to help us provide Nexus. Each subprocessor is selected for its security and data-protection practices and is bound by contractual obligations that are no less protective than those in our DPA.
Current list
| Vendor | Purpose | Data processed | Location |
|---|---|---|---|
| Brevo (Sendinblue) | Transactional and marketing email delivery (SMTP relay) | Recipient name, email address, message content | European Union (France) |
| Resend | Fallback transactional email delivery | Recipient name, email address, message content | United States / European Union |
| Amazon Web Services (S3-compatible storage) | Object storage for file uploads and backups | Files uploaded by customers; encrypted DB backups | Configured AWS region (currently EU) |
| PayPal | Payment processing for subscriptions and invoices | Billing identifiers, payment-method tokens, transaction metadata | Global; subject to PayPal’s own privacy terms |
| Anthropic | AI co-pilot features inside selected Modules (e.g., Finance) | Prompt content explicitly submitted by the customer when invoking AI features | United States |
| GoDaddy | DNS hosting for nexus.eslingshot.com and related domains | DNS records only; no customer data | United States |
| Let’s Encrypt | TLS certificate issuance and renewal | Domain names only; no customer data | United States |
| Postal (self-hosted) | Inbound email handling for support and customer correspondence | Email content addressed to our inbound domains | Operated by us on our infrastructure |
Changes
We will give at least 30 days’ prior notice before engaging a new subprocessor by updating this page and notifying the account owner by email. You may subscribe to updates by writing to hit@eslingshot.com with the subject line “Subscribe: subprocessor updates”.
You may object to a new subprocessor on reasonable data-protection grounds within the notice window. If we cannot offer a commercially reasonable alternative, either party may terminate the affected portion of the Services and receive a pro-rata refund of pre-paid, unused fees for that portion, in accordance with the DPA.
Internal infrastructure
In addition to the vendors above, we operate our own application and database infrastructure. We do not engage further subprocessors for hosting beyond what is listed.
Questions or objections: hit@eslingshot.com
Version 2026-05-14. See the legal index for the full pack.