Public List of Subprocessors
Last updated: September 5, 2026 · Version 2.1
This list presents, by category, the subprocessors authorized by EvoCODE IA® Ltda to process personal data on behalf of our Customers in the provision of the Kairo, TraceLog, and AgenteNOC products, pursuant to Clause 6 of our Data Processing Agreement (DPA). Each subprocessor is bound by a contract containing data protection obligations substantially equivalent to those of the DPA.
Identity of subprocessors: internal platform infrastructure vendors are presented by category, with purpose, data involved, location, and transfer safeguard. The identity of each subprocessor is provided to Customers and data subjects upon request to our Data Protection Officer (DPO), at dpo@evocode.ia.br, after verification of the requester — the Customer's account administrator or a data subject whose identity has been verified. Channels and integrations that the Customer chooses and knows — such as WhatsApp, Telegram, Discord, and the Customer's own connected accounts — and services loaded directly in the user's browser, described in the Cookie Policy, remain identified by name; third-party messaging channels are described in the Third-party channels section below.
Transfer safeguards: for data originating in Brazil and transferred abroad, the ANPD Standard Contractual Clauses (Resolution CD/ANPD No. 19/2024) apply; for processing subject to the GDPR/UK GDPR, the EU SCCs 2021/914 and, where applicable, the UK Addendum — indicated below as "ANPD SCCs / EU SCCs".
Some of the services listed are only engaged if the Customer activates the corresponding integration; integrations connected using the Customer's own account credentials (for example, their Google Workspace or their Zoom account) operate under the terms between the Customer and the respective vendor.
Common infrastructure (all products)
| Subprocessor category | Purpose | Data involved | Location/Region | Safeguard |
|---|---|---|---|---|
| Own hosting / cloud provider | Hosting of the application and database | All data processed on the platform | Brazil (primary) | Domestic processing; ANPD SCCs if secondary region is abroad |
| Transactional e-mail providers | Sending of transactional e-mails | Name, e-mail, content of transactional messages | USA/EU | ANPD SCCs / EU SCCs |
| Slack / Telegram (notifications) | Operational notifications configured by the Customer | Notification content (may contain data subjects' data) | USA / Global | ANPD SCCs / EU SCCs |
Kairo
| Subprocessor category | Purpose | Data involved | Location/Region | Safeguard |
|---|---|---|---|---|
| Stripe | Payment and subscription processing | Customer billing data (name, e-mail, tokenized payment method) | USA/EU | ANPD SCCs / EU SCCs |
| Artificial intelligence model providers (including configurable providers) | Generation of AI agent responses, transcription, voice, and research in external sources — processing of message content to generate responses | Content of conversations and commands sent to the agents; not used for training | USA/EU | ANPD SCCs / EU SCCs |
| Google (OAuth / Calendar) | Calendar synchronization and creation of Meet events | Identification of the connected account, events, availability, invitees | Global (USA/EU) | ANPD SCCs / EU SCCs |
| Microsoft (OAuth / Outlook / Teams) | Calendar synchronization and Teams meetings | Identification of the connected account, events, availability, invitees | Global (USA/EU) | ANPD SCCs / EU SCCs |
| Zoom | Creation of meeting links | Event data and meeting participants | USA | ANPD SCCs / EU SCCs |
| Transactional e-mail providers | Booking confirmation, reminder, and notification e-mails | Name, e-mail, booking data | USA/EU | ANPD SCCs / EU SCCs |
TraceLog
In addition to the common infrastructure items, Stripe, and the artificial intelligence model providers (under the same conditions as in the Kairo table):
| Subprocessor category | Purpose | Data involved | Location/Region | Safeguard |
|---|---|---|---|---|
| Cloudflare (Turnstile) | Anti-bot protection at login | IP address, technical browser signals | Global (edge network) | ANPD SCCs / EU SCCs |
| IP geolocation database provider | Approximate geolocation of IP addresses | IP address | USA | ANPD SCCs / EU SCCs |
| Cloud file storage provider | Storage of files and exports | Tenant files and reports (may contain personal data) | Per configured region (preference Brazil/São Paulo; otherwise USA/EU) | ANPD SCCs / EU SCCs |
AgenteNOC
In addition to the common infrastructure items and the artificial intelligence model providers (under the same conditions as in the Kairo table):
| Subprocessor category | Purpose | Data involved | Location/Region | Safeguard |
|---|---|---|---|---|
| Cloudflare (Turnstile) | Anti-bot protection on the authentication forms (login, registration, password reset) | IP address, technical browser signals | Global (edge network) | ANPD SCCs / EU SCCs |
| Error and performance monitoring provider | Error and performance monitoring (traces) of the platform services, including those that run the agents' tools | Technical error metadata; may contain user/context identifiers | USA/EU | ANPD SCCs / EU SCCs |
| AI observability platform | Debugging and improvement of the quality of service of the AI agents | Conversation content, instructions, and assistant responses, including tool calls | USA | ANPD SCCs / EU SCCs |
| Google LLC (Google Tag Manager / Google Analytics) | Audience measurement and usage analytics for the panel/application, when the integration is enabled | Online identifiers (cookies/client ID), usage and browsing data | USA/Global | ANPD SCCs / EU SCCs |
| VdoCipher | DRM player for course videos in the panel | Technical playback signals of the panel user | India/Global (CDN) | ANPD SCCs / EU SCCs |
| Cloud file storage and e-mail sending providers | File storage and e-mail sending | Files, audio, and transactional e-mails | Per configured region / USA-EU | ANPD SCCs / EU SCCs |
Third-party channels
The messaging channels below are chosen by the Customer and are not EvoCODE subprocessors; for that reason, they are not included in the tables above.
- WhatsApp (Meta Platforms) — a channel chosen by the Customer. The connection is made through integration software operated by EvoCODE, with no contractual relationship with Meta; Meta is not a subprocessor of EvoCODE and processes data under its own terms, as an independent controller. Use of this integration may be subject to restrictions imposed by Meta itself.
- Telegram and Discord — channels chosen by the Customer and connected through bots registered by the Customer itself; each platform processes data under its own terms, as an independent controller.
Updates to this list
We will notify Customers — by e-mail to the account administrator and/or by notice on the platform — with at least 15 (fifteen) days' advance notice before adding or replacing any subprocessor — including the replacement of a vendor within the same category — indicating its category, purpose, and location; the identity of each subprocessor is provided upon request to the DPO, including for the purpose of objection, pursuant to Clause 6.2 of the DPA. The current version of this list is always published in the legal hub at https://evocode.ia.br/legal, with date and version.
Right to object
The Customer may submit a reasoned objection to a new subprocessor, within 15 days of the notification (suspended until the requested identity is provided, pursuant to Clause 6.2 of the DPA), through the channel dpo@evocode.ia.br, stating the data protection grounds. We will follow the procedure set out in Clause 6.3 of the DPA: search for a reasonable alternative and, if unfeasible, the right to terminate the affected portion of the Services without penalty.
EvoCODE IA® Ltda — CNPJ 63.623.332/0001-42 Praça Nossa Senhora do Rosário, 44, Sala 02 — Centro, Piracaia/SP — CEP 12970-000 — Brasil, Brazil Website: https://evocode.ia.br · Legal contact: contato@evocode.ia.br · Support: sac@evocode.ia.br · WhatsApp: +55 51 2191-0021 Data Protection Officer (DPO): Elizandro Pacheco de Almeida — dpo@evocode.ia.br