Aprexx providers and subprocessors
Configuration described: 29 September 2026. This page lists the providers used by Aprexx’s managed cloud and the conditions evidenced for its current configuration. Modes run on customer infrastructure depend on that customer’s configuration.
Data sent from your computer
When you request an AI function, Aprexx sends the content needed for that
operation to Nereodata’s orchestrator. Text generation uses Vertex AI. Image
generation uses fal-ai/flux-2 through fal’s API. This function is currently
used on Nereodata’s own account; it has not been made available to customers.
Fal receives a text description derived from the request and presentation
content. Aprexx does not
attach customer documents, complete slides or customer supplied images to this
function by default. It does not automatically inspect or filter personal or
confidential information in that description.
Fal’s acceptable use policy excludes personal, sensitive and confidential information. Image requests must therefore omit such information. The managed cloud is also not intended for special categories under Article 9 GDPR or data concerning criminal convictions and offences under Article 10 GDPR.
AI and infrastructure providers
| Provider | Function and data received | Evidenced location | Evidenced retention | Transfers |
|---|---|---|---|---|
| Google Cloud — Cloud Run | Hosts the orchestrator; receives operation content in transit and during processing | Production in europe-southwest1 | Aprexx does not deliberately store prompts or results in an orchestrator database; Google’s logs and copies are governed by its terms | Google’s CDPA includes standard contractual clauses for applicable transfers; a European region does not rule out other access or ancillary flows |
| Google Cloud — Vertex AI | Text generation and review; receives instructions and content needed for the function | Inference configured for the eu endpoint | Implicit in-memory cache with a maximum TTL of 24 hours. Google has approved an exception to abuse-monitoring prompt logging for the production project; this does not establish general zero data retention | Standard contractual clauses under the Google Cloud CDPA where applicable |
fal — fal-ai/flux-2 | Image generation; receives the text description and returns an image | Fal does not evidence an exclusive EEA location for this endpoint. Its public list includes infrastructure providers identified in the United States, but does not assign each one to a particular request | Aprexx sends X-Fal-Store-IO: 0, which, according to fal’s documentation, prevents storage of request input and output JSON. sync_mode=true also returns the image as a data URI and keeps it out of request history. These settings do not establish zero retention of other logs or backups | Fal’s public DPA provides standard contractual clauses where applicable. Its coverage for this account and endpoint has not been verified |
Google Cloud’s terms include a commitment not to use Vertex AI content to
train models without authorisation. Fal’s API terms
include a training restriction and an exception for certain models. The
contractual classification of fal-ai/flux-2 for Nereodata’s account has not
been confirmed, so Aprexx does not present absence of training by fal as an
evidenced guarantee.
Account, licence and website
| Provider | Function and data received | Known location | Transfers |
|---|---|---|---|
| Supabase | Authentication, accounts and account email through NereoAuth; receives identity, email, session and licence data | Project in eu-west-1 (Ireland) | Standard contractual clauses applicable to access from outside the EEA |
| Cloudflare | Delivery, DNS and security for NereoAuth and the website; receives connection and traffic data | Global network | Applicable standard contractual clauses |
Cloudflare and Supabase do not receive presentation content sent to AI functions. Google Cloud Run processes it while running the orchestrator. Nereodata does not keep a persistent history of presentations, prompts or generated images in that service. The absence of that history does not mean zero retention by providers.
The Privacy Policy describes purposes, lawful bases and individuals’ rights. The service’s contractual terms and, where applicable, the data processing agreement govern the obligations between Nereodata and each customer.