This page identifies the sub-processors Sentus.ai, Inc. engages to deliver our services. It satisfies (a) the General Data Protection Regulation (GDPR) Article 28(2-4) controller-processor framework, (b) the California Consumer Privacy Act / CPRA service-provider disclosure expectation, and (c) the sub-processor schedule SOC 2 Type II auditors typically request as part of CC6/CC7 controls.

Categories below describe what each sub-processor does for Sentus, not the underlying vendor's product name. Sentus may add, remove, or substitute sub-processors as the technology landscape evolves; material changes will be reflected on this page. Customers under a Data Processing Addendum will additionally receive advance notice of any new sub-processor that processes personal data on their behalf.

1. Infrastructure & Edge Compute

Edge runtime, application delivery, and database: serverless compute, object storage, edge cache, and SQLite-class transactional database for tenant-scoped data.
Email transactional sending: system notifications, password-less login codes, receipts, and AI-assisted email replies are dispatched via a third-party transactional email service.

2. Communications

PSTN voice and SMS carrier: inbound and outbound telephone calls plus SMS messages to residents, prospects, and vendors are delivered through a third-party communications platform.
Conversational voice AI: "Sophia," our voice receptionist, is operated on a third-party conversational AI platform that provides speech-to-text, text-to-speech, and large language model inference.
Connected operator mailbox / calendar: property managers who connect their Google, Microsoft, or other email and calendar accounts to Sentus have those connections brokered by a third-party email-connectivity platform.

3. Foundation Model and AI Inference

Large language model inference: draft generation, summarization, classification, and natural-language reasoning use third-party foundation-model providers. Sentus does not train these models on customer data and configures provider relationships to disable training-data sharing where the provider offers that option.
AI inference observability and routing: AI requests pass through a gateway-class observability platform for cost and quality telemetry.

4. Payments

Payment card and ACH processing: resident rent and fee payments are processed via a PCI-DSS-compliant payment platform. The property management company is the merchant of record. Sentus does not store cardholder data.
Bank account verification: applicants who choose bank-account verification go through a third-party bank-link service that returns an account-verification token.

5. Background and Tenant Screening

Consumer reporting agencies (CRAs): credit, criminal, and eviction reports for rental applicants are sourced from licensed consumer reporting agencies under the Fair Credit Reporting Act.
Background check provider: identity verification and certain background checks are sourced from a third-party background-check platform.

6. Document Signing

Electronic signature platform: leases, addenda, and other documents requiring signature are dispatched and signed through a third-party e-signature platform that is ESIGN- and UETA-compliant.

7. Tax and Compliance Reporting

1099 e-filing: vendor and contractor tax reporting is dispatched through a third-party tax filing platform when payments exceed federal reporting thresholds.

8. Productivity and Customer Communications

Internal team productivity: Sentus operational and support workflows use third-party productivity, ticketing, and customer-success platforms.
Marketing newsletter: opt-in marketing communications are sent via a third-party newsletter platform separate from transactional email.
Push notifications: mobile and PWA push notifications are dispatched via Apple Push Notification service and Firebase Cloud Messaging.

9. Data Categories and Lawful Basis

Sub-processors process the minimum necessary categories of personal data to perform their function — typically resident or prospect contact information, payment and screening data, and communication content. Lawful basis is the performance of the contract between the property management customer and the resident or applicant, supplemented by legitimate interest in operational delivery and audit.

10. International Data Transfers

Sentus's primary data residency is the United States. Where a sub-processor operates outside the US, standard contractual clauses (SCCs) and equivalent transfer mechanisms apply consistent with GDPR Chapter V.

11. Adding or Replacing a Sub-Processor

Customers with an executed Data Processing Addendum will receive written notice at least 30 days before a new sub-processor begins processing personal data on their behalf, except where the change is required to respond to a security or legal incident. Customers may object to the addition of a sub-processor under the terms of their DPA.

12. Requests and Inquiries

To request a sub-processor schedule for your account, a DPA, or to file a sub-processor objection:

Privacy: [email protected]
Legal: [email protected]

13. Updates

This page is updated when the sub-processor stack changes materially. The latest version is always available at /sub-processors.

Sub-Processors