Sub-processors

This page lists every third party that may process personal data on our behalf, what they do, where they process it, and the safeguard each transfer relies on. It is generated from the same registry the application uses, so it cannot drift from what we actually run.

We give 30 days' advance notice before adding a sub-processor that affects business customers, as set out in our Data Processing Agreement. To be notified of changes, write to [email protected].

Where and how your data is processed overall is described in Section 7 of our Privacy Policy.

Infrastructure

Provider	What they do	Legal entity	Where	Safeguard
Hetzner	application hosting and compute, the primary database and caching and real-time message delivery	Hetzner Online GmbH (through Hetzner US LLC)	United States	Standard Contractual Clauses
Cloudflare R2	file and media storage and encrypted database backups	Cloudflare, Inc.	United States	Data Privacy Framework, with SCCs as fallback
Amazon Web Services	a second, write-once backup copy, secrets management and encryption keys and running code you or an agent asks us to run	Amazon Web Services EMEA SARL (through Amazon Web Services, Inc.)	United States	Data Privacy Framework, with SCCs as fallback
RunPod	GPU cloud computers	RunPod, Inc.	United States	Standard Contractual Clauses
Brevo	sending account and service email	Brevo SAS	France	Processed in the EEA, no transfer
PostHog	product analytics and error tracking	PostHog, Inc.	Germany	Standard Contractual Clauses

Business and operations

Provider	What they do	Legal entity	Where	Safeguard
Stripe	payment processing, subscriptions, invoicing and referral commission payouts (Stripe Connect)	Stripe Payments Europe, Limited	Ireland, United States	Data Privacy Framework, with SCCs as fallback
Cloudflare (CDN, DNS and Turnstile)	content delivery, DNS, TLS and bot protection	Cloudflare, Inc.	United States	Data Privacy Framework, with SCCs as fallback
Google Ads	measuring which adverts led to sign-ups, only where you accept marketing cookies	Google Ireland Limited	Ireland, United States	Data Privacy Framework, with SCCs as fallback
Brave Search API	answering web searches you or an agent run	Brave Software, Inc.	United States	Standard Contractual Clauses
Bright Data	fetching public web pages on your behalf	Bright Data Ltd	Israel	Adequacy decision

Sign-in and notifications

Provider	What they do	Legal entity	Where	Safeguard
Apple Push Notification service	delivering notifications to iOS devices	Apple Distribution International Ltd	Ireland, United States	Data Privacy Framework, with SCCs as fallback
Firebase Cloud Messaging	delivering notifications to Android devices	Google Ireland Limited	Ireland, United States	Data Privacy Framework, with SCCs as fallback
Google, Microsoft and GitHub sign-in	signing you in when you choose one of these providers	Google Ireland Limited, Microsoft Ireland Operations Ltd, GitHub, Inc.	Ireland, United States	Data Privacy Framework, with SCCs as fallback

AI model providers

AI model providers receive your prompts solely to generate the responses you request. Their jurisdiction below is sourced from their own published policies, with the quote and retrieval date recorded in our routing data. What each provider does with prompts, including whether it trains on them, is shown in your AI Routing settings, where you can also restrict routing to providers we have verified do not train on your data.

Provider	What they do	Legal entity	Where	Safeguard
Anthropic	generating the responses you request	Anthropic PBC	United States	Standard Contractual Clauses
Cohere	generating the responses you request	Cohere Inc.	United States	Standard Contractual Clauses
DeepInfra	generating the responses you request	DeepInfra, Inc.	United States	Standard Contractual Clauses
DeepSeek	generating the responses you request	Hangzhou DeepSeek Artificial Intelligence Co., Ltd.	China	Standard Contractual Clauses
Fireworks	generating the responses you request	Fireworks AI, Inc.	United States	Standard Contractual Clauses
Google	generating the responses you request	Google LLC	United States	Data Privacy Framework, with SCCs as fallback
Groq	generating the responses you request	Groq, Inc.	United States	Standard Contractual Clauses
Luma	generating the responses you request	Luma AI, Inc.	United States	Standard Contractual Clauses
MiniMax	generating the responses you request	Shanghai MiniMax Technology Co., Ltd.	Singapore	Standard Contractual Clauses
OpenAI	generating the responses you request	OpenAI, L.L.C.	United States	Data Privacy Framework, with SCCs as fallback
OpenRouter	routing your prompt to the model you selected	OpenRouter, Inc.	United States	Standard Contractual Clauses
Replicate	generating the responses you request	Replicate, Inc.	United States	Standard Contractual Clauses
Runway	generating the responses you request	Runway AI, Inc.	United States	Standard Contractual Clauses
Together	generating the responses you request	Together Computer, Inc.	United States	Standard Contractual Clauses
xAI	generating the responses you request	X.AI LLC	United States	Standard Contractual Clauses

Providers reached through OpenRouter

When you select a model served through the OpenRouter gateway, your prompt reaches the provider serving that model. We do not hold a contract with these providers, so we do not list a legal entity or a safeguard for them: that relationship is OpenRouter's. We do list who they are, and the country each one publishes, so you can see the full chain. Blank means the provider publishes nothing we could source.

You can restrict which providers your workspace may use, or route only to providers verified not to train on your data, in AI Routing.

Akashml, Amazon (United States), AtlasCloud (United States), Azure (United States), Baidu (China), Baseten (United States), Black Forest Labs, ByteDance Seed (Singapore), Cerebras (United States), Chutes (United States), Cloudflare (United States), Coreweave, Crusoe, Darkbloom, Decart, Deepgram, DekaLLM (ID), Digitalocean, Fish Audio, Friendli (United States), Gmicloud (United States), Google Ai Studio (United States), Heygen, Ideogram, Inception, Inceptron (SE), Inferencenet, Io Net (United States), Ionstream (United States), Kling, Krea, Makora, Mancer 2, Mara (United States), Meta (United States), Microsoft, Mistral (France), Modal, ModelRun (United States), Moonshot AI (Singapore), Morph (United States), Near Ai, Nebius (Netherlands), Nextbit (ES), Novita (United States), Openinference, Parasail (United States), Phala (United States), Primeintellect, Qwen (China, Singapore), Recraft, Reka, Relace, Sail Research, SambaNova, SiliconFlow (Singapore), StepFun (HK), Streamlake (China), Tencent, Unbiased, Venice (United States), Wafer (United States), Xiaomi (China, Netherlands, Singapore), Z.AI (Singapore).