This page lists the third-party sub-processors that Motionworks AI, Inc. ("Motionworks") engages to provide the Motionworks Services, as referenced in the Motionworks Data Processing Addendum and Privacy Policy.
This list is the live, authoritative source. We update this page when sub-processors change. Material changes are communicated to customers per Section 5 of the DPA.
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud infrastructure: compute, storage, database hosting | All measurement outputs, customer inputs, query results, account data | US (us-east-1, us-west-2) |
| Cloudflare | CDN, DDoS protection, DNS, edge security | API request metadata, IP addresses (transient), traffic patterns | US primary, global edge |
| Supabase | Authentication, consent ledger, application database | User authentication tokens, consent records, account metadata | US |
| Google LLC | Identity provider (Google Sign-In) | Google account ID, name, email address, profile picture (when user signs in with Google) | US |
| Microsoft Corporation | Identity provider (Microsoft Sign-In) | Microsoft account ID, name, email address (when user signs in with Microsoft) | US |
| GitHub, Inc. | Identity provider (GitHub Sign-In) | GitHub account ID, username, public email address (when user signs in with GitHub) | US |
| Stripe | Payment processing and billing | Billing addresses, payment method details (held by Stripe), invoices | US |
| SendGrid (Twilio) | Transactional email | Customer email addresses, notification content | US |
Motionworks provides at least thirty (30) days' advance written notice before engaging a new sub-processor or materially changing the scope of an existing sub-processor's engagement. Notice is provided via email to the address associated with the customer's account and posted to this page.
A customer may object to a new sub-processor by providing written notice to legal@mworks.com within fifteen (15) days of receiving the advance notice. The objection must include specific, reasonable grounds related to data protection concerns. Motionworks will use commercially reasonable efforts to address the concern, which may include additional safeguards or an alternative configuration. If Motionworks cannot reasonably accommodate the objection, either party may terminate the affected Services upon thirty (30) days' written notice without penalty.
Each sub-processor is bound by a written agreement that imposes data protection obligations no less protective than those set forth in the Motionworks Data Processing Addendum.
To receive notifications when this list changes, set the legal_notifications preference in your account settings, or email legal@mworks.com with the subject line "Sub-processor change notifications."