Overview
We engage the sub-processors below to deliver the Service. Each is bound by a written agreement imposing data protection obligations no less protective than those in our Data Processing Addendum, and each is limited to processing personal data on our instructions.
A sub-processor is engaged only where it is necessary to operate, secure, or support the Service. We remain responsible to our customers for our sub-processors' performance.
Current sub-processors
The table below reflects the sub-processors engaged as at the date of this document. Model providers are engaged only for the AI features a customer chooses to use.
| Sub-processor | Purpose | Data categories | Primary location |
|---|---|---|---|
| OVHcloud SAS | Application hosting and deployment | Account, usage, technical data | France |
| Cloudflare, Inc. | DNS, CDN, TLS termination, and DDoS protection | Technical data, IP address, request metadata | United States |
| Supabase, Inc. | Managed database, authentication, and file storage | Account, configuration, message content and metadata | United States / European Union |
| OpenAI, L.L.C. | Language model inference for agent reasoning and responses | Message and task content submitted for processing | United States |
| Anthropic, PBC | Language model inference for agent reasoning and responses | Message and task content submitted for processing | United States |
| Google LLC / Google Cloud | Cloud infrastructure and model inference for selected features | Message and task content submitted for processing | United States / European Union |
| Meta Platforms, Inc. and Meta Platforms Ireland Ltd. | WhatsApp Business Cloud API message delivery | Contact identifiers, message content and metadata | United States / Ireland |
| Functional Software, Inc. (Sentry) | Error monitoring and performance diagnostics | Technical data, limited identifiers in diagnostic context | United States |
| Dodo Payments | Merchant of Record — subscription checkout, billing, tax collection and remittance. Payment collection is conducted by EYELEVEN LLC, a group affiliate of Eyeleven Inc., acting as the contracting entity with Dodo Payments. | Billing contact, transaction records, payment instrument tokenisation | United States |
How we select sub-processors
- Security review of the vendor's technical and organisational measures before engagement
- A written data processing agreement, including the Standard Contractual Clauses where the vendor is outside the EEA, UK, or Switzerland
- Assessment of the vendor's own sub-processing chain and breach notification commitments
- Preference for vendors offering data residency options and, for model providers, zero-retention or no-training configurations for API traffic
- Periodic re-review, and removal where a vendor no longer meets our requirements
Notice of changes
We will update this page at least thirty days before a new sub-processor begins processing Customer Personal Data, except where an urgent replacement is necessary to maintain security or continuity of the Service — in which case we will publish the change as soon as practicable.
To receive email notification of changes, write to [email protected] with the subject line “Sub-processor notifications”. Customers may object to a new sub-processor on reasonable data protection grounds as set out in the Data Processing Addendum.
Transfers to sub-processors
Where a sub-processor processes personal data outside the EEA, the United Kingdom, or Switzerland, the transfer is covered by the Standard Contractual Clauses together with the UK Addendum or Swiss addendum as applicable, or by another lawful mechanism such as the EU–US Data Privacy Framework where the vendor is certified.
Contact
Questions about this list, or requests for the underlying data processing agreements, should be sent to [email protected].