Subprocessor List

This page lists the sub-processors that NEUROSCALE LLC (“Neuroscale”) engages to process customer personal data (“Customer Personal Data”) in connection with the Neuroscale services. It supports our Data Processing Addendum (DPA) and our Privacy Notice.

​

1. What is a sub-processor?

Consistent with Article 28 of the GDPR, a “sub-processor” is a third party that Neuroscale engages to process Customer Personal Data on our behalf — for example, a cloud-infrastructure provider that hosts the database where Customer Personal Data is stored. Sub-processors are bound by written contracts that impose data-protection obligations no less protective than those in our DPA with the customer. This page does not list every vendor Neuroscale uses. It lists vendors that may process Customer Personal Data on our behalf to deliver the services, plus a small number of operational vendors whose access to Customer Personal Data is incidental and tightly scoped (e.g., logging, monitoring). Internal-only tools that do not process Customer Personal Data are out of scope of this list.

​

2. Notification of changes

We commit to providing customers with at least 30 days advance notice before adding a new sub-processor that will process Customer Personal Data, or at least 14 days notice where exigent circumstances exist (for example, where adding the sub-processor is necessary to address a security or availability issue). Customers may object to a new sub-processor as set out in the DPA. To receive sub-processor change notifications by email, subscribe through the Neuroscale Trust Center (Vanta-hosted) using the “Subscribe to updates” option. Email privacy@neuroscale.ai if you cannot access the Trust Center and we will add you to the notification list directly.

​

3. Current sub-processors

The “Transfer mechanism” column indicates how cross-border transfers are addressed where the sub-processor processes data outside the data subject’s country: DPF = the EU-U.S. Data Privacy Framework (and UK Extension / Swiss-U.S. DPF where applicable); SCCs = the EU Standard Contractual Clauses (and UK International Data Transfer Addendum where applicable); DPA = a written data processing agreement with the sub-processor; N/A = domestic processing where no cross-border transfer mechanism is required for the relevant data.

​

3.1 Website / marketing analytics and advertising recipients

The recipients below are website and marketing-tier recipients, not product sub-processors: they receive limited Visitor data (e.g., cookie identifiers, device/usage signals) collected on Neuroscale’s public marketing websites, and they do not process Customer Personal Data submitted to the Arbi services. Non-essential tags load only after the corresponding cookie consent is granted. The cookies and similar technologies these recipients set are described in the Cookie Notice.

​

4. Affiliates

Neuroscale’s affiliates (entities under common control with NEUROSCALE LLC) may also process Customer Personal Data on Neuroscale’s behalf, subject to the same contractual protections that apply to sub-processors.

​

5. Subscribing to changes

To be notified when a sub-processor is added, removed, or replaced, subscribe through the Neuroscale Trust Center (Vanta-hosted) using the “Subscribe to updates” option, or email privacy@neuroscale.ai to be added directly. Subscribers receive notice consistent with our DPA commitments.

​

6. Contact

• Privacy: privacy@neuroscale.ai
• Legal / DPA: legal@neuroscale.ai
• Postal: NEUROSCALE LLC, 46175 Westlake Dr Ste 300, Sterling, VA 20165

For our overall privacy program, see the Privacy Notice.