Sub-processors
Last updated: July 20, 2026
We use the following sub-processors to provide Change Agent. Each processes personal data only on our instructions, under a data-processing agreement (see status below), and only as needed for its stated purpose. Region/transfer details should be confirmed against each provider's current documentation and your account configuration.
| Sub-processor | Purpose | Personal data processed | Location | DPA status |
|---|---|---|---|---|
| WorkOS | Authentication, SSO, MFA | Identity (email, name, auth identifiers) | US | In progress |
| Supabase | Application database (users, conversation metadata, sessions, usage events, feedback) | Identity, conversation metadata, usage, feedback (incl. screenshots) | US East (AWS us-east-1, N. Virginia) | Signed |
| OpenRouter | LLM request routing | Prompts + responses (routed, not stored by OpenRouter; request metadata retained). Retention at the destination provider is listed per provider below. | US | In progress |
| Google (Gemini via Vertex AI) | Primary language model | Prompts + responses — zero retention; does not train | US / EU / Global (OpenRouter-routed; pinned to Vertex — AI Studio endpoints disabled) | Via OpenRouter |
| Meta (Llama) | Evaluation-tier language model | Prompts + responses (when used) — retained 30 days; does not train | US | Via OpenRouter |
| OpenAI | Text embeddings | Search query text. Called directly, not routed via OpenRouter; retention governed by OpenAI's API terms | US | In progress |
| LangChain — LangGraph Platform | Agent orchestration; stores conversation state/checkpoints | Prompts + responses (conversation state) | US (GCP) | Signed |
| LangChain — LangSmith | Observability / tracing | Prompts + responses (traces) | US (GCP, us-central-1) | Signed |
| Vercel | Frontend hosting / edge | Request metadata (IP, user-agent); no conversation content stored | US East (Vercel iad1) | In progress |
| Neo4j Aura | Knowledge-base graph (read-only at request time) | None user-identifiable (queries only; no user content stored) | US (GCP us-east1, South Carolina) | In progress |
DPA status key. Signed — a data-processing agreement is executed with this provider. In progress — requested or under review. Via OpenRouter — reached through OpenRouter rather than a direct account, so the OpenRouter agreement is the governing contract.
Notes
- No training on user data: providers are operated in no-training configurations (routing configured to exclude training endpoints; primary model under enterprise terms). See the Privacy Policy §3.
- Retention at model providers: the retention shown for each model provider is that provider's own published policy as reported by OpenRouter, accurate as of the date above. Provider policies can change without notice to us; we re-check them when this list is reviewed.
- Encryption: all transfers over TLS; data encrypted at rest (AES-256 in Neo4j Aura / Supabase; encryption at rest per LangChain's published security program).
- Cross-border transfers: US-located sub-processors are covered by SCCs and/or EU-US Data Privacy Framework certification — tracked in
DPA_SCC_TRACKER.md. - This list is maintained as sub-processors change; subscribe at https://forms.microsoft.com/r/QWP6JcXRK2 for advance notice.