Public List of Subprocessors
Last updated: September 1, 2026 · Version 2.1
This list identifies the subprocessors authorized by EvoCODE IA® Ltda to process personal data on behalf of our Customers in the provision of the Kairo, TraceLog, and AgenteNOC products, pursuant to Clause 6 of our Data Processing Agreement (DPA). Each subprocessor is bound by a contract containing data protection obligations substantially equivalent to those of the DPA.
Transfer safeguards: for data originating in Brazil and transferred abroad, the ANPD Standard Contractual Clauses (Resolution CD/ANPD No. 19/2024) apply; for processing subject to the GDPR/UK GDPR, the EU SCCs 2021/914 and, where applicable, the UK Addendum — indicated below as "ANPD SCCs / EU SCCs".
Some of the services listed are only engaged if the Customer activates the corresponding integration; integrations connected using the Customer's own account credentials (for example, their Google Workspace or their Zoom account) operate under the terms between the Customer and the respective vendor.
Common infrastructure (all products)
| Subprocessor | Purpose | Data involved | Location/Region | Safeguard |
|---|---|---|---|---|
| Own hosting / cloud provider | Hosting of the application and database | All data processed on the platform | Brazil (primary) | Domestic processing; ANPD SCCs if secondary region is abroad |
| Amazon SES / Resend / Postmark | Sending of transactional e-mails | Name, e-mail, content of transactional messages | USA/EU | ANPD SCCs / EU SCCs |
| Slack / Telegram (notifications) | Operational notifications configured by the Customer | Notification content (may contain data subjects' data) | USA / Global | ANPD SCCs / EU SCCs |
Kairo
| Subprocessor | Purpose | Data involved | Location/Region | Safeguard |
|---|---|---|---|---|
| Stripe | Payment and subscription processing | Customer billing data (name, e-mail, tokenized payment method) | USA/EU | ANPD SCCs / EU SCCs |
| OpenAI and configurable AI providers (Google Gemini, Anthropic, Cohere, etc.) | Generation of AI agent responses, transcription, and voice | Content of conversations and commands sent to the agents; not used for training | USA/EU | ANPD SCCs / EU SCCs |
| Evolution API → Meta Platforms (WhatsApp) | Sending and receiving WhatsApp messages | Phone number, message and media content, metadata | Global (Meta: USA/EU) | ANPD SCCs / EU SCCs |
| Google (OAuth / Calendar) | Calendar synchronization and creation of Meet events | Identification of the connected account, events, availability, invitees | Global (USA/EU) | ANPD SCCs / EU SCCs |
| Microsoft (OAuth / Outlook / Teams) | Calendar synchronization and Teams meetings | Identification of the connected account, events, availability, invitees | Global (USA/EU) | ANPD SCCs / EU SCCs |
| Zoom | Creation of meeting links | Event data and meeting participants | USA | ANPD SCCs / EU SCCs |
| Amazon SES / Resend / Postmark | Booking confirmation, reminder, and notification e-mails | Name, e-mail, booking data | USA/EU | ANPD SCCs / EU SCCs |
TraceLog
In addition to the common infrastructure items and to Stripe, OpenAI, and Evolution→Meta (under the same conditions as in the Kairo table):
| Subprocessor | Purpose | Data involved | Location/Region | Safeguard |
|---|---|---|---|---|
| Cloudflare (Turnstile) | Anti-bot protection at login | IP address, technical browser signals | Global (edge network) | ANPD SCCs / EU SCCs |
| MaxMind (GeoIP2) | Approximate geolocation of IP addresses | IP address | USA | ANPD SCCs / EU SCCs |
| AWS S3 | Storage of files and exports | Tenant files and reports (may contain personal data) | Per configured region (preference Brazil/São Paulo; otherwise USA/EU) | ANPD SCCs / EU SCCs |
AgenteNOC
In addition to the common infrastructure items and the AI providers (under the same conditions as in the Kairo table):
| Subprocessor | Purpose | Data involved | Location/Region | Safeguard |
|---|---|---|---|---|
| Sentry | Error and performance monitoring (traces) | Technical error metadata; may contain user/context identifiers | USA/EU | ANPD SCCs / EU SCCs |
| Evolution API → Meta Platforms (WhatsApp) | WhatsApp service channel of the agents | Phone number, content of conversations and audio, group participants | Global (Meta: USA/EU) | ANPD SCCs / EU SCCs |
| Telegram | Telegram service channel | User identifiers, conversation content, group participants | Global | ANPD SCCs / EU SCCs |
| Discord | Discord service channel | User identifiers, conversation content, server participants | USA | ANPD SCCs / EU SCCs |
| VdoCipher | DRM player for course videos in the panel | Technical playback signals of the panel user | India/Global (CDN) | ANPD SCCs / EU SCCs |
| AWS S3 / SES | File storage and e-mail sending | Files, audio, and transactional e-mails | Per configured region / USA-EU | ANPD SCCs / EU SCCs |
Updates to this list
We will notify Customers — by e-mail to the account administrator and/or by notice on the platform — with at least 15 (fifteen) days' advance notice before adding or replacing any subprocessor, indicating its identity, purpose, and location. The current version of this list is always published in the legal hub at https://evocode.ia.br/legal, with date and version.
Right to object
The Customer may submit a reasoned objection to a new subprocessor, within 15 days of the notification, through the channel dpo@evocode.ia.br, stating the data protection grounds. We will follow the procedure set out in Clause 6.3 of the DPA: search for a reasonable alternative and, if unfeasible, the right to terminate the affected portion of the Services without penalty.
Version history
Below we record the material changes to this list. The current version and the other pieces of the legal corpus are published in the legal hub at https://evocode.ia.br/legal.
Version 2.1 — September 1, 2026
- Removal of the Laravel Nightwatch subprocessor. The application telemetry and monitoring service is no longer used and was removed from this list — from both the common infrastructure table and the Kairo table — as well as from Section 5.2 of the Privacy Policy. Because this is a removal, and not the addition or replacement of a subprocessor, the 15 (fifteen)-day advance notice set out in the "Updates to this list" section does not apply, since that notice exists to allow a reasoned objection to a new subprocessor.
- TraceLog telemetry retention policy. The revision of retention periods published in this same version of the corpus (a 40-day technical floor for raw measurements, a 60-day window for accounts without an active plan, and the reduction of the TraceLog Pro plan to 90 days) does not change this list: it appears in the Terms of Service (Annex II.3), the Privacy Policy (Sections 2.3 and 7), and the Data Processing Agreement (Annex I-B).
- Version history. This section was created, so that the record of changes now appears within the document itself, and not only in the legal hub.
Version 2.0 — July 22, 2026
- Original text of this document, published in the consolidation of EvoCODE IA®'s legal corpus (Terms of Service, Acceptable Use Policy, Privacy Policy, Cookie Policy, Data Processing Agreement, Public List of Subprocessors, and Legal Notice).
EvoCODE IA® Ltda — CNPJ 63.623.332/0001-42 Praça Nossa Senhora do Rosário, 44, Sala 02 — Centro, Piracaia/SP — CEP 12970-000 — Brasil, Brazil Website: https://evocode.ia.br · Legal contact: contato@evocode.ia.br · Support: sac@evocode.ia.br · WhatsApp: +55 51 2191-0021 Data Protection Officer (DPO): Elizandro Pacheco de Almeida — dpo@evocode.ia.br