Third-party Sub-processors

Natural AI, Inc. ("Natural") engages certain third parties to help provide the Natural technology and services. Some of these third parties process Personal Data on behalf of Natural's customers and at their direction. This page identifies those third parties as Natural's sub-processors.

Capitalized terms not defined below have the meanings stated in the Data Processing Agreement ("DPA").

What is a sub-processor?

A sub-processor is a third party that Natural engages to process Personal Data on behalf of a customer and at the customer's direction in connection with providing the Natural technology and services. Natural remains responsible to its customers for Natural's sub-processors' performance of their obligations.

The Current Sub-processors list below does not include third parties that Natural engages solely to support its own internal business operations, that do not process Personal Data, or that process Personal Data as independent controllers rather than on behalf of Natural or its customers.

Current Sub-processors

Natural currently engages the following third parties to process Personal Data as sub-processors.

Infrastructure and Hosting

Entity	Purpose of processing	Location of processing
Amazon Web Services, Inc.	Cloud infrastructure, compute, and data storage for the Natural technology	United States
Vercel Inc.	Application deployment, web hosting, and edge delivery of Natural's customer-facing interfaces	United States
Datadog, Inc.	Application performance monitoring, logging, and error tracking	United States
Evervault Limited	Encryption and tokenization of cardholder data within Natural's PCI environment	United States; Ireland

Payments and Money Movement

Entity	Purpose of processing	Location of processing
Column N.A.	Sponsor bank services, including deposit account servicing, ACH and wire origination, and settlement of transactions initiated through the Natural technology	United States
TabaPay, Inc.	Card acquiring and merchant payment processing	United States
Bridge Ventures Inc. (Stripe, LLC)	Stablecoin (USDC) payment and settlement infrastructure	United States
Plaid Inc.	Connection and verification of end-user external bank accounts	United States

Identity, Compliance, and Risk

Entity	Purpose of processing	Location of processing
Persona Identities, Inc.	Identity verification and document review for individual end users (KYC)	United States
Osiris Ratings, Inc. dba Baselayer	Business verification data and beneficial ownership information for business customers (KYB)	United States
Oscilar, Inc.	KYC, KYB, sanctions and AML screening, and transaction risk decisioning	United States
Twilio Inc.	Phone and email verification, one-time passcodes, and service notifications	United States

Customer Communications and Support

Entity	Purpose of processing	Location of processing
Zendesk, Inc.	Customer support ticketing and correspondence	United States
Slack Technologies, LLC (Salesforce, Inc.)	Customer communication channels and internal support coordination	United States
Plus Five Five, Inc. dba Resend	Delivery of transactional and service email	United States
Google LLC	Business email, calendar, and document storage used in the course of customer communications and support	United States

Product Analytics

Entity	Purpose of processing	Location of processing
PostHog Inc.	Product usage analytics and telemetry for Natural's customer-facing interfaces	United States

Financial Partners

Natural provides certain payment and account services in partnership with financial institutions, including Column N.A., Natural's sponsor bank, and, for card acquiring, Cross River Bank through TabaPay, Inc. These institutions process personal data both on Natural's behalf and, in part, as independent controllers in order to meet their own legal and regulatory obligations, including obligations under applicable banking, anti-money laundering, and sanctions laws. Their processing in that capacity is governed by their own privacy notices.

Natural Affiliates

Natural may engage the following affiliates to support the provision of Natural's services.

Entity	Purpose of processing	Location
Natural AI, Inc.	Provision, support, and administration of the Natural technology	United States (Delaware corporation; operations in California)
Natural SPV, LLC	Account servicing for Natural customers	United States

Changes

When Natural adds or replaces a sub-processor, it updates this page and notifies customers by email. Under the DPA, a customer with reasonable grounds relating to data protection may object to Natural's appointment of a new sub-processor in writing within 30 days of Natural's notice. Natural will work with the customer in good faith to address the objection. This page is provided for information; the DPA governs.

Contact

Please direct questions about this page or Natural's privacy practices to privacy@natural.com.