Subprocessors
Who else processes data for NEXUS Build
The providers the platform code uses (26 October 2026). The platform starts without them: a provider receives data only after its key is set, and in production no provider is simulated.
01 / 10
Anthropic — Claude API
- 01
Used for
Planning the specification, writing the application’s code and translating catalog texts; also the estimate agent on the public estimate page.
- 02
Data sent
The request written by the user (redacted first and cut to 20,000 characters), the answers to clarifying questions, the specification, the application’s current files, the failed checks, the texts to translate and the visitor’s conversation with the estimate agent.
- 03
Limits on the model
The model gets no tools: it cannot approve, publish or run commands.
- 04
Where
The provider does not name a country or region. Transfers from the EU are made on the standard contractual clauses (modules 2 and 3), under Irish law; the data processing agreement is accepted together with the commercial terms. Their list of subprocessors: https://www.anthropic.com/subprocessors
02 / 10
E2B — the build sandbox
- 01
Used for
Each build gets a new virtual machine, where packages are installed, the application is checked and built, and the preview is served.
- 02
Data sent
The generated application’s files and a single-use session secret; no platform key. Only synthetic data and synthetic accounts.
- 03
Network
From the sandbox, only the npm package registry can be reached.
- 04
Where
The provider does not name its default region. E2B offers an EU cluster on request; NEXUS has not requested it yet, so only synthetic data goes into the sandbox.
03 / 10
Fly.io — published applications
- 01
Used for
One Fly application for each published project; its machines stop when they are not used.
- 02
Data sent
The client application’s code, its runtime secrets (access to its own Supabase project) and all the traffic of the application’s users.
- 03
Where
The platform’s default region is fra, which Fly.io lists as Frankfurt, Germany.
04 / 10
Supabase — databases of published applications
- 01
Used for
One Supabase project (database, sign-in, file storage) for each published application.
- 02
Data sent
The data entered by the application’s users, the documents uploaded to a portal (in a private bucket), rows imported from Excel / CSV files and the reads for PDF documents.
- 03
Where
The platform’s default region is eu-central-1, which Supabase lists as Central EU (Frankfurt).
05 / 10
Stripe — NEXUS billing
- 01
Used for
Payments for plans, credits and projects, on the Stripe Checkout page hosted by Stripe.
- 02
Data sent
The client’s e-mail when a project is paid, the description of the payment and internal identifiers (payment, organization, product). Card data never passes through the platform: it is entered on the Stripe page.
- 03
Where
The provider’s privacy page does not say clearly where data is stored; it names Stripe, LLC (United States) and Stripe Technology Company, Limited (Ireland).
06 / 10
Stripe Connect — payments in client applications
- 01
Used for
The client’s own Stripe account (a connected account) and the payments made in their application, with a key separate from NEXUS billing.
- 02
Data sent
Project and order identifiers. The identification data of the client’s company is requested by Stripe directly, on its own onboarding page.
- 03
Where
As for Stripe billing: not stated clearly by the provider.
07 / 10
E-mail — the support@nexuscompany.ro mailbox
- 01
Used for
Account confirmation, the “account already exists” notice, password reset, the offers, previews and changes sent to clients, and notices to the team.
- 02
Data sent
The recipient’s address, the subject and the text of the message, with its link.
- 03
Where
An SMTP mail server (the company’s cPanel mailbox). Its hosting provider and location are not listed on this page yet.
08 / 10
Hetzner Cloud — the platform server
- 01
Used for
One server running the platform, its database and its cache. All platform data is there: accounts, organizations, projects, messages, version files and the nightly database copies. The company website runs on the same server.
- 02
Where
Nuremberg. The hosting provider also keeps 7 daily copies of the whole server.
09 / 10
Hetzner Storage Box — off-site copies (not switched on yet)
- 01
Status
Prepared in the code, not configured yet: today it receives no data.
- 02
Data, once switched on
The platform database and the version files, encrypted with AES-256-GCM before they leave the server. The restore key does not reach the provider.
10 / 10
Services without personal data
Not subprocessors, but the platform connects to them; listed so the list is complete.
- 01
GitHub
The server takes its code from the repository, with a read-only token.
- 02
get.docker.com
Installs Docker, once.
- 03
Let’s Encrypt (through Caddy)
The HTTPS certificate: receives only the domain name.
- 04
mirror.gcr.io (Google)
Downloads, anonymously, the base Node image of the applications.
- 05
registry.npmjs.org
The packages installed in the sandbox.
Passed on outside the platform
The support assistant on the public pages is a service of the nexuscompany.ro website: a visitor’s question is sent to it over the server’s internal network. The providers that assistant uses are not listed on this page yet.
NEXUS Build
Have an application in mind?
Describe it in a few sentences. You get a specification to approve before anything is built.
Need a custom project instead?
NEXUS AI Company also designs and builds websites, apps and software to order, as a separate service.
Discuss a project