Subprocessors
In one line
The companies that process customer data for us, what they do, where, and what data they touch. We give 30 days' notice before adding one.
The short version
This short version helps you understand the full text. Read the full text for the complete terms.
- This list names every company that processes your workspace data for us. (Full text, section 1)
- Each one is under a written contract with data protection terms. (Section 2)
- We give at least 30 days' notice before a new one starts handling your data. You may object. (Section 3)
- Rows marked "To confirm" are in our code but not yet confirmed as used for customer data. We will confirm or remove them before launch. (Section 1)
- A machine-readable copy is at /trust/subprocessors.json. (Section 4)
Current list
Accurate as of 2026-10-10. Machine-readable: subprocessors.json.
| Provider | What they do | Data | Where | Status |
|---|---|---|---|---|
| Vercel Vercel Inc. | Application hosting and serverless compute; AI Gateway routing to model providers | All workspace data in transit; Request logs | United States (global edge) EU SCCs; Data Privacy Framework (to confirm) | Active |
| Cloudflare Cloudflare, Inc. | DNS, TLS, edge security, staff access control (Access), and media object storage (R2) | Request metadata; Uploaded and generated media | Global edge; R2 region to confirm EU SCCs; Data Privacy Framework | Active |
| Supabase Supabase, Inc. | Managed Postgres database | Account data; Workspace content; Encrypted tokens; Authorisation records | Singapore (current; target region to be decided) EU SCCs; UK Addendum; Swiss amendments | Active |
| WorkOS WorkOS, Inc. | Customer sign-in, single sign-on, and multi-factor authentication | Name; Email; Sign-in records | United States EU SCCs; Data Privacy Framework (to confirm) | Active |
| Anthropic Anthropic, PBC | Large language models (Claude) for drafts, Brand Kit plans, and Checks | Prompts containing workspace content; Model outputs | United States EU SCCs | Active |
| fal Features & Labels, Inc. (fal.ai) | Image and video generation and editing | Prompts; Reference images; Generated media | United States EU SCCs (to confirm) | Active |
| Upstash Upstash, Inc. | Rate limiting and short-lived counters | IP addresses (hashed or raw, to confirm); Request counts | Region to confirm EU SCCs (to confirm) | Active |
| Sentry Functional Software, Inc. (Sentry) | Error monitoring | Error reports; IP address; Browser data | United States (EU region available, to decide) EU SCCs; Data Privacy Framework | Active |
| ElevenLabs Eleven Labs, Inc. | Voice-over and audio generation (only with consent under the Voice and Likeness Consent Policy) | Scripts; Consented voice samples | To confirm To confirm | Planned |
| OpenAI OpenAI, L.L.C. / OpenAI Ireland Ltd | Alternative language models (present in code) | Prompts; Outputs | United States To confirm | To confirm |
| Google (Gemini) Google LLC / Google Ireland Ltd | Alternative language and image models (present in code) | Prompts; Outputs | To confirm To confirm | To confirm |
| xAI X.AI LLC | Alternative language models (present in code) | Prompts; Outputs | United States To confirm | To confirm |
| OpenRouter OpenRouter, Inc. | Model routing (present in code) | Prompts; Outputs | United States To confirm | To confirm |
| Z.ai To confirm | Alternative language models (present in code) | Prompts; Outputs | To confirm (possibly China) To confirm | To confirm |
| Ayrshare Ayrshare, Inc. | Social publishing API (present in code) | Post content; Channel identifiers | United States To confirm | To confirm |
Not subprocessors
- Meta, TikTok, LinkedIn, Google (YouTube): Platforms you instruct us to publish to. They receive content under their own terms as independent controllers.
- Payment provider: To be chosen; will be listed before billing starts.
History
- 2026-10-10 · First draft list published for review.
Full text
Read the full text (about 1 minute)
1. Current list
The table on this page is generated from /trust/subprocessors.json, so both always match.
2. Contracts
Each subprocessor has signed, or accepted, a data processing agreement with terms at least as protective as our DPA, including international transfer safeguards where needed. AI providers are contractually barred from training on our data.
3. Changes
We update this page and the JSON file at least 30 days before a new subprocessor starts handling customer data, and record the change in the history below. To get an email, write to [CONTACT EMAIL] with the subject "Subscribe: subprocessor changes". You may object, giving data protection reasons, during those 30 days (see DPA section 6).
4. Machine-readable file
/trust/subprocessors.json uses a simple schema: name, legal entity, purpose, data categories, location, transfer mechanism, retention, status, and date added.
Change log
- 2026-10-10 · 0.1.0 · First list, built from the current architecture and code.
Open questions for counsel
We publish these while the page is a draft, so you can see what is not settled yet.
- Confirm each provider's contracting entity, DPA, region, and retention settings (for example, Anthropic zero data retention eligibility, Vercel AI Gateway routing).
- Rows marked "To confirm" must be resolved before publication.
Useful for: Business owners, IT and security reviewers, Platform reviewers. To save this page as a PDF, use your browser's Print command. Back to the trust centre.