Sub-processors
This page lists every third party that may process personal data on our behalf, what they do, where they process it, and the safeguard each transfer relies on. It is generated from the same registry the application uses, so it cannot drift from what we actually run.
We give 30 days' advance notice before adding a sub-processor that affects business customers, as set out in our Data Processing Agreement. To be notified of changes, write to [email protected].
Where and how your data is processed overall is described in Section 7 of our Privacy Policy.
Infrastructure
| Provider | What they do | Legal entity | Where | Safeguard |
|---|---|---|---|---|
| Hetzner | application hosting and compute, the primary database and caching and real-time message delivery | Hetzner Online GmbH (through Hetzner US LLC) | United States | Standard Contractual Clauses |
| Cloudflare R2 | file and media storage and encrypted database backups | Cloudflare, Inc. | United States | Data Privacy Framework, with SCCs as fallback |
| Amazon Web Services | a second, write-once backup copy, secrets management and encryption keys and running code you or an agent asks us to run | Amazon Web Services EMEA SARL (through Amazon Web Services, Inc.) | United States | Data Privacy Framework, with SCCs as fallback |
| Turbopuffer | search indexing over your content | turbopuffer, Inc. | United States | Standard Contractual Clauses |
| RunPod | GPU cloud computers | RunPod, Inc. | United States | Standard Contractual Clauses |
| Brevo | sending account and service email | Brevo SAS | France | Processed in the EEA, no transfer |
| PostHog | product analytics and error tracking | PostHog, Inc. | Germany | Standard Contractual Clauses |
Business and operations
| Provider | What they do | Legal entity | Where | Safeguard |
|---|---|---|---|---|
| Stripe | payment processing, subscriptions and invoicing | Stripe Payments Europe, Limited | Ireland, United States | Data Privacy Framework, with SCCs as fallback |
| Cloudflare (CDN, DNS and Turnstile) | content delivery, DNS, TLS and bot protection | Cloudflare, Inc. | United States | Data Privacy Framework, with SCCs as fallback |
| Google Ads | measuring which adverts led to sign-ups, only where you accept marketing cookies | Google Ireland Limited | Ireland, United States | Data Privacy Framework, with SCCs as fallback |
| Brave Search API | answering web searches you or an agent run | Brave Software, Inc. | United States | Standard Contractual Clauses |
| Bright Data | fetching public web pages on your behalf | Bright Data Ltd | Israel | Adequacy decision |
Sign-in and notifications
| Provider | What they do | Legal entity | Where | Safeguard |
|---|---|---|---|---|
| Apple Push Notification service | delivering notifications to iOS devices | Apple Distribution International Ltd | Ireland, United States | Data Privacy Framework, with SCCs as fallback |
| Firebase Cloud Messaging | delivering notifications to Android devices | Google Ireland Limited | Ireland, United States | Data Privacy Framework, with SCCs as fallback |
| Google, Microsoft and GitHub sign-in | signing you in when you choose one of these providers | Google Ireland Limited, Microsoft Ireland Operations Ltd, GitHub, Inc. | Ireland, United States | Data Privacy Framework, with SCCs as fallback |
AI model providers
AI model providers receive your prompts solely to generate the responses you request. Their jurisdiction below is sourced from their own published policies, with the quote and retrieval date recorded in our routing data. What each provider does with prompts, including whether it trains on them, is shown in your AI Routing settings, where you can also restrict routing to providers we have verified do not train on your data.
| Provider | What they do | Legal entity | Where | Safeguard |
|---|---|---|---|---|
| Anthropic | generating the responses you request | Anthropic PBC | United States | Standard Contractual Clauses |
| Cohere | generating the responses you request | Cohere Inc. | United States | Standard Contractual Clauses |
| DeepInfra | generating the responses you request | DeepInfra, Inc. | United States | Standard Contractual Clauses |
| DeepSeek | generating the responses you request | Hangzhou DeepSeek Artificial Intelligence Co., Ltd. | China | Standard Contractual Clauses |
| Fireworks | generating the responses you request | Fireworks AI, Inc. | United States | Standard Contractual Clauses |
| generating the responses you request | Google LLC | United States | Data Privacy Framework, with SCCs as fallback | |
| Groq | generating the responses you request | Groq, Inc. | United States | Standard Contractual Clauses |
| Luma | generating the responses you request | Luma AI, Inc. | United States | Standard Contractual Clauses |
| MiniMax | generating the responses you request | Shanghai MiniMax Technology Co., Ltd. | China | Standard Contractual Clauses |
| OpenAI | generating the responses you request | OpenAI, L.L.C. | United States | Data Privacy Framework, with SCCs as fallback |
| Replicate | generating the responses you request | Replicate, Inc. | United States | Standard Contractual Clauses |
| Runway | generating the responses you request | Runway AI, Inc. | United States | Standard Contractual Clauses |
| Together | generating the responses you request | Together Computer, Inc. | United States | Standard Contractual Clauses |
| xAI | generating the responses you request | X.AI LLC | United States | Standard Contractual Clauses |
Providers reached through OpenRouter
When you select a model served through the OpenRouter gateway, your prompt reaches the provider serving that model. We do not hold a contract with these providers, so we do not list a legal entity or a safeguard for them: that relationship is OpenRouter's. We do list who they are, and the country each one publishes, so you can see the full chain. Blank means the provider publishes nothing we could source.
You can restrict which providers your workspace may use, or route only to providers verified not to train on your data, in AI Routing.
Aionlabs, Akashml, Amazon (United States), Ambient, AtlasCloud (United States), Azure, Baidu, Baseten, Black Forest Labs, ByteDance Seed, Cerebras (United States), Chutes (United States), Clarifai, Cloudflare (United States), Decart, DekaLLM, Digitalocean, Friendli, Gmicloud, Google Ai Studio (United States), Ideogram, Inceptron, Io Net, Ionstream, Kling, Mara, Meta, Mistral (France), ModelRun, Moonshot AI (Singapore), Morph, Nebius (Netherlands), Nextbit, Novita (United States), Parasail (United States), Phala, Qwen (China, Singapore), Recraft, SambaNova, SiliconFlow, StepFun, Streamlake, Venice (United States), Wafer, Wandb, Xiaomi, Z.AI.