Trust & Security
Subprocessors
Last updated: October 9, 2026
We engage the third-party service providers below (Subprocessors) to help deliver the Services. We will post 15 days’ advance notice of any material changes (e.g., adding a new Subprocessor) on this page. If you have questions or an objection on reasonable data-protection grounds, contact [email protected].
Two data scopes we process for you:
- Customer Content = content you submit to the Services (e.g., invoice files, instructions, extracted fields).
- Customer Account Data = user identities used to access/administer your org (e.g., names, emails, auth identifiers, org membership/roles).
Application hosting is in the United States and the European Union; the database and object storage are in the United States. Certain AI model providers may process Customer Content globally for inference. For international transfer mechanisms (e.g., SCCs / UK transfer addendum on request), see the DPA.
Only active Subprocessors are listed.
| Subprocessor | Purpose | Processes Customer Content? | Processes Customer Account Data? | Primary region(s) |
|---|---|---|---|---|
| Render | Application hosting (infrastructure) | Yes (infrastructure host; incidental) | Yes (infrastructure host; incidental) | US |
| Hetzner | Application hosting (infrastructure) | Yes (infrastructure host; incidental) | Yes (infrastructure host; incidental) | EU |
| Supabase | Managed Postgres (account & task metadata) | Yes (task/processing metadata) | Yes (org/account metadata) | US |
| Cloudflare R2 | Object storage (uploads/outputs) | Yes | No | US |
| Clerk | Authentication (accounts/login) | No (auth only) | Yes (names, emails, auth IDs, org membership/roles) | US (global infra possible) |
| OpenAI | AI model inference | Yes | No | Global infrastructure possible |
| Anthropic | AI model inference | Yes | No | Global infrastructure possible |
| Google Gemini | AI model inference | Yes | No | Global infrastructure possible |
| OpenRouter | Model gateway (some models) | Yes | No | Global infrastructure possible |
| Google Workspace | Business email/support | No (business comms; not Customer Data unless you email content/files) | No | US |
| Postmark | Email delivery (account, task, and product emails) | No (email address, name, and notification text; no invoice files or extracted data) | Yes (names, emails) | US |
| GitHub | Source code and internal records | No | No | US |
“Customer Content” and “Customer Account Data” are defined above and align with our DPA. We act as your processor for both scopes. We do not permit AI providers to train on Customer Content and retention is disabled/minimized where configurable.
Other Providers (Not Subprocessors)
These providers support our commercial operations but do not process Customer Data on our behalf as defined in our DPA (they are independent controllers/businesses)
| Provider | Purpose | Primary region(s) |
|---|---|---|
| Paddle | Payments (Merchant of Record / reseller); buyer & payment info handled under Paddle’s terms | Global |
Change Log
- Nov 6, 2025: Initial publication of Subprocessors page.
Future changes will be listed here at least 15 days before they take effect.