Sub-processors Approach

1. Purpose

This document sets out the categorical approach Nexwift takes when engaging sub-processors to deliver the Aram platform. It is intended for prospective and existing customers, their compliance teams, and any authority reviewing our sub-processor governance. The document does not name individual sub-processors.

2. Guiding Principle

Nexwift engages sub-processors only where necessary to deliver the Aram platform reliably, securely, and at the quality of service our customers expect. We do not add a sub-processor to reduce internal effort, to introduce optional analytics, or to enable adjacent commercial activity. Every sub-processor in scope performs a defined function that Nexwift cannot reasonably perform in-house at equivalent security and reliability.

3. Roles Under Applicable Law

For services delivered through the Aram platform, Nexwift typically acts as a Data Processor on behalf of the customer organisation, which is the Data Controller. Sub-processors we engage act as further processors (sub-processors) to Nexwift and, transitively, to the customer.

Nothing in this document displaces the customer Data Controller's primary responsibility under the Kingdom of Saudi Arabia's Personal Data Protection Law (PDPL), the implementing regulations issued by SDAIA, or, where applicable, the EU General Data Protection Regulation (GDPR).

4. Categories of Sub-processors

Nexwift's sub-processor footprint is limited to the categories below. Each category is engaged for the narrow purpose stated in its row.

Operational suppliers used by Nexwift staff — source-code hosting and continuous integration, internal identity and email, and the public status page — process only Nexwift-staff-facing data and are not sub-processors of customer personal data. They are governed under our Supplier and Third-Party Risk Policy.

5. Due Diligence and Contractual Safeguards

Before onboarding, and on an annual review cycle thereafter, each sub-processor is assessed against the following criteria:

• Recognised international information-security certifications, typically ISO/IEC 27001, SOC 2 Type II, or equivalent.
• Published security posture, breach history, and public regulatory record.
• Contractual exclusion of customer inputs from provider model training, where the category involves AI inference.
• Data residency options aligned with the customer's requirements.
• Financial and operational stability appropriate to the criticality of the function.

Every sub-processor in scope is bound by a written Data Processing Agreement (DPA) that imposes data-protection obligations substantially equivalent to those between Nexwift and its customers, aligned with the standards set by PDPL and GDPR. For widely-used cloud and AI providers, Nexwift contracts on the provider's standard published data-processing terms, provided those terms are recognised as aligned with GDPR / PDPL standards. Nexwift uses commercially reasonable efforts to obtain equivalent protections in every case.

6. Data Residency

The primary processing region for the Aram platform is the European Union. Sub-processors are selected, and configurations are pinned, so that customer personal data is processed within the European Union by default. Where a category (for example, a messaging channel platform reachable only through the platform operator's global infrastructure) makes strict EU-only processing impossible, the transfer is placed on a recognised safeguard.

Customer-specific residency requirements — for example, a requirement to restrict AI inference to a single named provider in a specific region — are agreed in the DPA and implemented per tenant.

7. AI Provider Specifics

For sub-processors in the AI inference category:

• The managed AI provider set is not limited to a single vendor and may be extended over time under this same governance.
• On a customer's documented requirement, the provider set for that customer's environment can be restricted (for example, to a single named provider or to a specific data-residency region), as agreed in the DPA.
• Requests carry only message text, retrieved context, and the system prompt required for the AI to formulate a reply.
• Logging and telemetry sent to error-monitoring providers exclude personal data by default; the client SDK scrubs before transmission.

8. Customer Right to Object

Sub-processor governance, including notice and objection mechanics for material changes, is set out in the DPA. On receipt of an objection, Nexwift and the customer will negotiate in good faith to identify a remediation — for example, restricting the customer's tenant to an alternative provider in the same category, adjusting the processing region, or agreeing additional safeguards. Where a reasonable objection cannot be remediated, next steps — including the possibility of scoped termination of the affected service component — are discussed in accordance with the DPA and the Master Agreement.

9. Liability and Coverage Across Text, Voice, and Video

Nexwift remains liable to the customer for the performance of its sub-processors' data-protection obligations to the same extent that Nexwift is liable for its own performance, subject to the limitations of liability set out in the Master Agreement.

The sub-processor approach applies across all channels supported by the Aram platform — text, voice, and video. Voice and video services rely on additional sub-processor categories, specifically telephony provider(s) and WebRTC / media infrastructure provider(s).

Call and video recording is an optional feature and is customer-configurable per use case. Where the customer enables recording, the customer is responsible for obtaining and evidencing beneficiary consent as required by applicable law. Customer data — configurations, knowledge-base content, transcripts, recordings, and summaries — remains owned by the customer. Nexwift retains ownership of the platform, its models, and aggregated telemetry that does not identify a customer, a beneficiary, or the content of a communication.

10. Contact

For objections to a notified change, or for any other question about this approach:

info@nexwift.com — Attention: Data Protection Officer.

11. Governing Law and Jurisdiction

This document, and the sub-processor governance it describes, is governed by the laws of the Kingdom of Saudi Arabia. The competent courts and authorities of the Kingdom of Saudi Arabia have jurisdiction over any dispute arising in connection with it, without prejudice to any customer-specific dispute-resolution mechanism set out in the Master Agreement or DPA.

12. Scope and Reservations

This document is a statement of approach and is not a warranty. It is provided for information and to support customer diligence. It does not replace the DPA, the Master Agreement, or any Statement of Work. AI-assisted outputs generated by the Aram platform are advisory only and are not a substitute for medical, legal, or financial advice; the voice channel is not an emergency service. Nexwift may update this document from time to time. The current version is always available at this URL.