# MicroExtract Subprocessor and Service Provider Schedule

**Approved for publication. Effective only when published as an approved version in MicroExtract.**

WORKFLOW AUTOMATION PTE. LTD. uses the following verified service providers in the current MicroExtract production architecture.

| Provider | Verified MicroExtract purpose | Data potentially involved | Processing location statement |
| --- | --- | --- | --- |
| Supabase | Authentication, production PostgreSQL database, private Storage and server-side application services | Account identity, workspace data, customer documents, extracted data and operational records | Production project region is Singapore (ap-southeast-1). Some provider support or platform operations may involve other locations under provider terms. |
| Cloudflare | Web application delivery, Workers, Turnstile, rate limiting, queues and edge networking | Network and security metadata, application requests and data processed by configured edge services | Cloudflare operates a global network. No Singapore-only Cloudflare processing commitment is made unless a separately contracted Data Localization configuration is enabled. |
| OpenAI | AI document extraction through the OpenAI API | Document page content, extraction instructions and generated extraction results | Provider-managed processing may occur outside Singapore unless an eligible customer-specific data residency configuration is separately enabled. Current MicroExtract extraction calls use store:false, and OpenAI API data is not used for model training by default. |
| Stripe | Checkout, subscriptions, billing portal and billing webhooks | Customer identity, billing and subscription information; payment information handled by Stripe | Provider-managed global processing under Stripe contractual and privacy terms. |
| Google | Optional Google OAuth identity provider | Google account identity and authentication information for users choosing Google Sign-In | Provider-managed global processing under Google terms. |
| Elastic Email | MicroExtract authentication and transactional email delivery | Recipient email address and authentication or system email content | Provider-managed processing that may involve cross-border data transfers under Elastic Email terms. |

## Provider control

MicroExtract uses only providers required for the Service and reviewed for the relevant operational and data-protection purpose.

This schedule does not authorise a provider merely because it appears elsewhere in the broader MicroPlatform codebase.

## Overseas processing

Where personal data is transferred outside Singapore and the Personal Data Protection Act applies, Workflow Automation Pte. Ltd. will take steps appropriate to its role to meet applicable transfer requirements.

No blanket Singapore-only data-residency commitment is made for MicroExtract.

Enterprise customers requiring a specific residency arrangement must have that requirement expressly agreed in writing and technically validated.

## Changes

Material changes to subprocessors or processing arrangements will be reflected in the published schedule.

Enterprise customers may receive contractual notice or objection rights where expressly agreed in a Data Processing Agreement or Order Form.