Subprocessors and Data Locations

This page lists the third-party providers (“subprocessors”) that Soluciones de Software Toracom (“Toracom”, “we”) uses to operate Mexus CRM, and the effective locations where customer data is stored and processed. It complements our Privacy Notice, which describes the locations where our providers may operate; this page describes where they do operate for the Mexus CRM service.

1. Where customer data lives

All customer data of the Mexus CRM service (the shared platform at app.mexuscrm.com) is stored and processed in Amazon Web Services region us-west-2, Oregon, United States:

Component	Provider	Location
Database (records, notes, activities, history) and authentication	Supabase, Inc. (running on AWS)	Oregon, USA
Uploaded files (documents, profile photos, logos)	Supabase, Inc. (running on AWS)	Oregon, USA
Database backups	Supabase, Inc.	Same region as the database (Oregon, USA)
Application servers	Amazon Web Services, Inc. (App Runner)	Oregon, USA
Campaign material and inbound email files	Amazon Web Services, Inc. (S3)	Oregon, USA
Email delivery	Amazon Web Services, Inc. (SES)	Oregon, USA
Application logs	Amazon Web Services, Inc. (CloudWatch)	Oregon, USA

Data is encrypted in transit (TLS) and at rest.

Support access. Toracom personnel provide technical support remotely from Mexico (Guadalajara, Jalisco). Access is limited to authorized staff and is used only to operate the service or to respond to a customer request.

Dedicated deployments. Customers with a dedicated deployment receive written confirmation of their specific locations as part of their agreement.

2. Subprocessors that process customer data

Subprocessor	Purpose	Location
Amazon Web Services, Inc.	Hosting of the application, file storage, email delivery, scheduled jobs and logs	United States (Oregon)
Supabase, Inc.	Managed database, authentication and file storage	United States (Oregon, on AWS). Supabase’s own subprocessors are listed at supabase.com

3. Subprocessors used only for specific functions

These providers only receive data when the related function is used.

Subprocessor	When it is used	Data involved	Location
Stripe, Inc.	Paying the Mexus CRM subscription by card	Billing contact and payment data of the subscribing company. It does not receive the records stored in the CRM	United States and Stripe’s global infrastructure
Cloudflare, Inc.	Web forms embedded in a customer’s website (anti-bot check)	IP address and browser signals of the person filling in the form	Cloudflare global network

4. Integrations the customer connects to its own accounts

When a customer connects one of these services, data is exchanged with the customer’s own account at that provider, under the terms the customer accepted with that provider. They are not Toracom subprocessors, and nothing is shared with them unless the customer connects them.

Google (Calendar and Drive), per user.
Meta (WhatsApp Business Platform and Lead Ads).
AI assistants connected through the Mexus CRM connector (for example, Claude by Anthropic), using the customer’s own account with the assistant provider.

5. How we notify changes

At least 30 days before a new subprocessor begins to process customer data, or before customer data is stored or processed in a different region, we update this page and email the administrators of every account.
A customer may object to the change during that period by writing to privacidad@mexuscrm.com. If we cannot address the objection, the customer may terminate the affected service before the change takes effect.
If a provider must be replaced urgently to protect the security or continuity of the service, we will notify as soon as possible and explain why the standard notice could not be given.
Anyone else may ask to receive these notices by writing to privacidad@mexuscrm.com.

6. Contact

Privacy email: privacidad@mexuscrm.com
Address: Av. Faro 2350 1E, Verde Valle, CP 44550, Guadalajara, Jalisco, Mexico