Sub-Processor Register

Effective August 21, 2026. This register is referenced by the Arcvue Data Processing Agreement and by our Privacy Policy, and we provide it on request.

It distinguishes three categories, because the distinction carries legal weight. A sub-processor processes Customer Personal Data on Arcvue's behalf. A customer-directed integration is a system you already use and instruct Arcvue to connect to, using credentials you supply. A public data source involves no customer data leaving the platform at all. We update this register before any new integration goes live, and we give every customer fourteen (14) days' notice before a new sub-processor begins processing Customer Personal Data.

1. Sub-Processors

These providers process Customer Personal Data on Arcvue's behalf. Each is bound by a written agreement with data protection terms substantially equivalent to our Data Processing Agreement. All are located in the United States.

Amazon Web Services. Infrastructure hosting, storage, and backup. Customer data at rest and in transit; tenant databases; document storage; service telemetry. Hosted in us-east-1, Northern Virginia.

Anthropic, PBC. The AI Assistant, where a tenant enables it. Query text and the context submitted with it. No bulk export of customer data, and the provider retains nothing after the response is generated.

Microsoft Corporation. Email delivery of reports and alerts via the Graph API, where a customer configures it. Report content and recipient email addresses.

Sentry. Crash and diagnostic reporting for Arcvue Mobile. A crash report carries the error and the reporting user's employee ID and organization—never financial records. The client is configured to collect nothing beyond that attribution. Errors in the web application are handled by Arcvue directly and never reach Sentry.

Expo. Mobile push notification delivery. Device notification tokens and notification content.

Apple Inc. and Google LLC. Mobile application distribution and platform services. Device identifiers; and where voice time entry is used, the operating system's speech recognition—on iPhone recognition runs on the device, and on Android audio is sent to Google's recognizer, as our Privacy Policy discloses.

Disclosed, not yet processing. The following is approved and disclosed ahead of activation, and is not presently active for any customer. It will process Customer Personal Data on Arcvue's behalf only where you link an account. Publication of this entry is the fourteen (14) days' notice described in section 4; on activation it joins the list above and the register is updated the same day.

Plaid. Bank and credit card account aggregation. Arcvue holds the Plaid integration account; you authenticate to your own financial institution through Plaid and authorize the link to Arcvue. On activation it receives the account and transaction data for the accounts you link, and the identity data you submit in authenticating. Plaid is the only route by which the platform connects to a financial institution. United States.

2. Customer-Directed Integrations

Arcvue connects to these at your instruction, using credentials you supply. The integrations provisioned for your tenant are identified on your Order Form. Arcvue's processing of the data received is governed by our Data Processing Agreement; your relationship with each provider is governed by your own agreement with that provider.

ERP and accounting systems. Intuit QuickBooks Online, UNANET, Deltek Costpoint, Sage Intacct, JAMIS, and Microsoft Dynamics 365 / GovCon365: general ledger transactions, chart of accounts, contract and project records, invoice and revenue data, and labor and timekeeping data, per the connection you authorize. PROCAS involves no connection at all—it is a manual CSV export you upload, so there is no credential, no token, and no automated pull.

Banking and financial data. Mercury: bank account and transaction data for the accounts you connect. Account aggregation through Plaid is listed in section 1 instead, because Arcvue holds that integration account rather than you.

Payroll and HR. Insperity: employment records and compensation data.

Accounts payable. Bill.com: vendor records and payment data.

3. Public Data Sources

No customer data is transmitted to these. They are read-only public reference sources: GSA CALC+ for public labor rate benchmarks, USAspending.gov for public federal award data, and SAM.gov and public procurement data for opportunity and entity information.

4. Changes to This Register

Before any new third party receives customer data, the register is updated and the entry is categorized. Where it is a sub-processor, we confirm a written agreement with data protection terms substantially equivalent to our Data Processing Agreement, give every customer fourteen (14) days' written notice before processing begins, and publish the update here the same day. An objection raised within the notice period is resolved before the integration is enabled for that tenant. The register is reviewed at each annual policy review.

5. Contact

For questions about this register, or to receive sub-processor notices at a specific address, contact us at info@arcvue.ai.