Subprocessors
Xavier uses the subprocessors below to provide the Service. Each processes Customer Data only to perform its service for Xavier, under written terms that include data protection obligations, as described in the Data Processing Addendum.
To be told about changes to this list at least 30 days in advance, ask to subscribe through our contact form.
1. Subprocessors
| Subprocessor | Purpose | Customer Data involved | Location |
|---|---|---|---|
| Google LLC (Google Cloud) | Application hosting, networking, secret storage, logging and monitoring | All Customer Data passing through the Service; service logs including IP addresses | United States (us-east1, South Carolina) |
| MongoDB, Inc. (MongoDB Atlas) | Database hosting and backups | All Customer Data stored by the Service, except for Tenants that keep their data in their own database; account and billing records | United States (South Carolina); for Tenants whose Order specifies another storage region, that region |
| Resend (Plus Five Five, Inc.) | Sending email: alerts, invoices, account and password emails | Recipient names and email addresses; email content, which may include device names and alert details | United States (Virginia) |
| Stripe, Inc. | Card payment processing | Organization name, billing email, Tenant identifier, payment card details (entered directly with Stripe) | United States |
| Cloudflare, Inc. (Turnstile) | Bot protection on trial signup | IP address and browser signals of the person signing up | United States and global network |
| OpenStreetMap Foundation (Nominatim) | Converting a device’s recorded location into a place name when an administrator views it | Latitude and longitude of a Managed Device | Netherlands, Ireland, and United States, through a global CDN |
| OpenStreetMap Foundation (map tiles) | Map images shown in the admin console for device locations | The administrator’s IP address and the map area being viewed (requested by the administrator’s browser) | Global CDN; tile servers in Europe, the United States, and Taiwan |
2. Services you choose to connect
The following are not Xavier subprocessors. The Service exchanges data with them only when you configure the integration or enroll devices of that platform, and their processing is governed by your own agreement with them.
| Service | What it is used for |
|---|---|
| Apple (Apple Push Notification service, Apple Business Manager, Apple School Manager, Volume Purchase Program, Activation Lock, App Store) | Managing Apple devices, automated enrollment, app licensing |
| Google (Google Workspace, Google sign-in, Android Management API) | Importing people and groups, End User sign-in during enrollment, managing Android devices |
| Microsoft (Microsoft Entra ID, Microsoft Graph, winget) | Importing people and groups, End User sign-in during enrollment, Windows software catalog |
| Samsung Knox Mobile Enrollment | Automated enrollment of Samsung devices |
| Okta and other OpenID Connect identity providers | End User sign-in during enrollment |
| Chocolatey and NuGet package feeds | Windows software packages you deploy |
| Slack, Microsoft Teams, Google Chat, webhooks, and SMTP servers | Delivering alerts to destinations you configure |
| Your storage account (Amazon S3, Google Cloud Storage, or another S3-compatible service) | Storing files you upload, such as installers, packages, and media |
| Your own MongoDB database, if used | Storing your Tenant’s data instead of Xavier’s database |
| AI assistants and MCP clients | Querying your Tenant through the read-only MCP server with a token you create |
3. Services that receive no personal data
To report vulnerabilities, end-of-life dates, and available updates, the Service looks up software names and version numbers with public databases and package registries, including the GitHub Advisory Database, OSV.dev, endoflife.date, SOFA (macadmins.io), Homebrew, npm, PyPI, RubyGems, NuGet, and Maven Central. These requests contain software names and versions only, not information about your devices or people.