Trust and security · 10
Sub-processor List
NexToCloud · NTC CAPITAL HOLDING S.A.S. · NIT (Colombian tax ID) 902.096.121-7 Version 2.0 · Last updated: October 20, 2026
1. Core infrastructure#
| Provider | Function | Data processed | Location |
|---|---|---|---|
| Microsoft Corporation (Azure) | Hosting of the Platform, databases, cache (Azure Managed Redis), backups, secrets vault, and API gateway | All Customer Data | United States (East US 2; backup in Central US) |
| Vercel Inc. | Hosting of the web applications and the website (the AI gateway is described in section 3) | Browsing and session data | United States and global edge network |
Swipe the table to the right to see all columns.
2. Communications#
| Provider | Function | Data processed | Location |
|---|---|---|---|
| Meta Platforms Ireland Limited (WhatsApp Business Platform; contracting entity for businesses in Colombia) | WhatsApp messaging, when NexToCloud manages the account | Phone number, profile name, and message content | Meta global infrastructure |
| Twilio Inc. | WhatsApp BSP and telephony, where applicable | Phone number, message content, metadata, and call audio | United States |
| Resend (Plus Five Five, Inc.) | Transactional email (notifications, password recovery) | Name, email, and notification content | United States |
Swipe the table to the right to see all columns.
3. Artificial intelligence and voice#
| Provider | Function | Data processed | Location |
|---|---|---|---|
| Vercel Inc. (AI Gateway) | Single point of access to AI models, under zero data retention (ZDR). Vercel does not retain Inputs or Outputs after each request is completed. | AI Inputs and Outputs in transit | United States and global network |
| Model Providers with a zero retention agreement with Vercel AI Gateway (depending on the configured model, including, among others: Anthropic, OpenAI, Google Vertex AI, Amazon Bedrock, and Microsoft Azure) | Message interpretation, extraction, and response generation | AI Inputs and Outputs, without retention or use for training | Depending on the provider, mainly the United States |
Swipe the table to the right to see all columns.
4. NexToCloud internal operations (data relating to the Customer relationship)#
| Provider | Function | Data processed | Location |
|---|---|---|---|
| Microsoft Corporation (Microsoft 365) | Corporate email, documents, and support | Contact data and communications with customers | United States |
Swipe the table to the right to see all columns.
Third-Party Services contracted by the Customer#
When the Customer directly contracts its WhatsApp Business account, its BSP, its telephony carrier, or another service, that provider is not a NexToCloud Sub-processor: it acts on behalf of the Customer under the terms that the Customer accepted with it.
Versioned document. Previous versions are kept at nextocloud.ai/legal.