Subprocessors
Every third party that may process data on our behalf, and what each one does.
A subprocessor is a company we use to run the service that may process personal data on our behalf. The Data Processing Agreement authorises the subprocessors listed on this page, so this list is contractual rather than informational: adding a company to it is a change customers may object to.
The previous version of this page said it was "generated from that record so it cannot drift from reality", and it was not — it was a hand-written list of categories with no vendors named. This one names them. It is maintained by hand, and a test fails the build if a provider is added to the environment schema without appearing here.
Who processes data for us
Vercel Inc. — application hosting and content delivery for the website, the dashboard and the public chat endpoint. United States.
Neon Inc. — managed PostgreSQL. All account data and customer data is stored here. United States.
Google LLC (Cloud Key Management Service) — key management. Holds the key that wraps encrypted integration credentials; never sees the credentials themselves. United States.
Anthropic PBC — AI model provider. Processes conversation content to generate a reply, and is contractually prohibited from training on it. United States.
Stripe, Inc. — payment processing and subscription billing. Card details are entered on Stripe’s own pages and never reach our systems. United States.
Resend (Plus Five Five, Inc.) — transactional email delivery: confirmations, reminders, enquiry alerts and account email. United States.
Configured but not in use
OpenAI, L.L.C. may be configured as an additional model provider. It is listed here because the platform can route to it, not because every workspace does.
Twilio Inc. is named in our configuration for SMS and voice. An SMS provider is now implemented, and no message has yet been sent through it in production: the platform messaging service is not configured, and no customer has completed the carrier registration their own number requires. Twilio becomes a subprocessor on the day the first message is sent, and this page will say so before that happens rather than after.
Postmark and Amazon SES are accepted by our configuration as alternatives to Resend, and neither is implemented. Selecting one in production is now refused at start-up rather than silently falling back, so no mail can be routed to a provider we have not written.
Sentry is named in our configuration for error monitoring and is not connected. Nothing is sent to it. It would become a subprocessor if that changed, and we would publish it here first.
Cloudflare, Inc. (R2 object storage) will hold our off-site encrypted database backups. This entry is published in advance of the first backup rather than after it: under section 7 of the Data Processing Agreement you have fourteen days from this notice to object on reasonable data-protection grounds. What it will hold is ciphertext only — every backup is encrypted with a public key before it leaves our systems, and the private key needed to read one is not held by Cloudflare, not held by our build system, and not stored anywhere either of them can reach. United States and global edge.
Services you connect yourself
A calendar, a CRM or a mailbox that you connect is not our subprocessor. You are the one instructing it, under that provider’s own terms, and we act on the access you grant. Disconnecting it in your integrations settings stops that flow immediately.
Notice of changes
We publish a change to this page before a new subprocessor begins processing customer data. Under section 7 of the Data Processing Agreement you have fourteen days to object on reasonable data-protection grounds.