Trust Center
Subprocessor List
Catalystium, Inc. — Rhenari Platform
This Subprocessor List identifies the third parties that Catalystium, Inc. (“Catalystium”), a Delaware corporation, engages to process Customer Data in providing the Rhenari platform (the “Service”). It is published for the transparency of Catalystium's customers and their security reviewers, and to support the advance-notice commitments in the Data Processing Agreement.
1. About this list
This list is incorporated by reference into the Data Processing Agreement (the “DPA”) between Catalystium and each customer, and supplements Annex 3 of the DPA. Capitalized terms — including Customer Data, Personal Data, Service, and Subprocessor — have the meanings given in the DPA and the Master Subscription Agreement. Where this list and DPA Annex 3 differ, the Parties will reconcile them; the controlling document is the DPA as supplemented by this list.
2. What this list covers — and what it does not
A Subprocessor is a third party Catalystium engages to process Customer Data on its behalf in providing the Service. This list names those parties. Two categories are deliberately not on this list, because they are not Subprocessors:
- Connected sources you authorize. The business systems a customer chooses to connect to the Service (for example, collaboration, messaging, engineering, or project tools) are the customer's own integrations, enabled and controlled by the customer. They are sources of Customer Data, not parties Catalystium engages to process it, and they are not Subprocessors. The set of available sources changes over time and is described in the product, not in this list.
- Providers that support Catalystium's own business. Providers that handle Catalystium's website, marketing, or billing information — rather than Customer Data — are controller-side service providers, not Subprocessors. These are described in the Privacy Policy. For example, the privacy-focused analytics used on the Rhenari website processes website-visitor data, not Customer Data, and so is addressed there rather than here.
3. Current Subprocessors
Catalystium engages the following Subprocessors. The Service uses a dual-cloud architecture: the Microsoft data plane is hosted on Microsoft Azure, and the Google-marketplace data plane is hosted on Google Cloud.
| Subprocessor | Purpose and services | Processing location |
|---|---|---|
| Microsoft Corporation | Cloud infrastructure and platform hosting on Microsoft Azure — compute, storage, databases, key management, and analytics services (including Microsoft Fabric). AI model inference for the Service runs within the Azure environment (Azure OpenAI / Microsoft Foundry models); no model inference leaves the Azure boundary. Product notifications are delivered through Microsoft Teams and Microsoft Graph. Platform observability uses Azure Monitor, Application Insights, and Log Analytics. | United States |
| Google LLC (Google Cloud) | Cloud infrastructure for the Google-marketplace data plane on Google Cloud — managed databases (Cloud SQL for PostgreSQL and SQL Server), Secret Manager, key management (Cloud KMS), messaging (Pub/Sub), and monitoring and logging (Cloud Monitoring and Cloud Logging). Secure cloud-to-cloud connectivity uses Cross-Cloud Interconnect. | United States |
4. Engagements that are not separate Subprocessors
For the avoidance of doubt, the following functions do not introduce additional Subprocessors, because they are performed within the two cloud environments above or are not engaged to process Customer Data:
- AI model inference — performed within the Microsoft Azure environment; no separate AI provider processes Customer Data outside that boundary.
- Notifications — delivered through Microsoft Teams and Microsoft Graph, within the Microsoft environment; no separate email or notification vendor is engaged.
- Observability and logging — provided by Azure Monitor / Application Insights / Log Analytics and Google Cloud Monitoring / Logging, within the two clouds; no separate observability vendor is engaged.
- Product analytics — first-party only; no third-party product-analytics Subprocessor is engaged.
- Payments — billing is handled through the marketplaces and a third-party payment processor that receive business and account data only (such as billing contact and limited transaction records), never Customer Data; these are controller-side service providers described in the Privacy Policy, not Subprocessors.
5. Processing locations and data residency
All Subprocessor processing of Customer Data takes place in the United States, in primary and disaster-recovery regions. The Service does not currently use a Canadian hosting region.
Customers in Canada are served from United States regions. For those customers, Catalystium provides protection comparable to that required of an organization transferring personal information for processing, together with transparency about processing locations and Subprocessors, as set out in the DPA. Catalystium does not transfer Customer Data outside the United States other than as described here.
6. Changes and advance notice
Catalystium will give customers at least thirty (30) days' advance notice before adding or replacing a Subprocessor that processes Customer Data. Notice is given by updating this list and notifying customers through email delivered to the account administrator, consistent with the DPA.
7. Objecting to a Subprocessor
If a customer reasonably objects to a new Subprocessor on data-protection grounds within the notice period, the Parties will work together in good faith to address the objection, as set out in the DPA. Where the objection cannot be resolved, the customer's remedy is as stated in the DPA.
8. Contact
Questions about this Subprocessor List, or requests to receive change notices, can be sent to support@rhenari.com.