Start now

Legal

Sub-processors

To provide the service we rely on the providers listed here, which process personal data on our behalf. This is the current list referred to by the Privacy Policy and by clause 7.5 of the Terms.

Last updated · October 15, 2026

How we announce changes

Before adding or replacing a sub-processor we publish it here and announce it in the inbox of every workspace at least 30 days in advance. The users who manage a workspace on an Enterprise plan also receive it by email, and anyone who manages a workspace can turn that email on or off in their notification settings. Within that period you may object on reasonable and justified grounds by writing to [email protected].

Providers marked optional are engaged only if you turn on the feature that needs them. If you never turn it on, they never receive your data.

Infrastructure and hosting

5 providers

  • Amazon Web Services

    Application compute, inbound and outbound email through SES, and object storage.

    Entity
    Amazon Web Services EMEA SARL (Luxembourg)
    Processing
    • EU (eu-central-1, Frankfurt)
    Transfers
    EU-US Data Privacy Framework, with the Standard Contractual Clauses incorporated by reference in the DPA.
    Retention
    90 days after termination to return or delete customer data through the service controls.
    Certifications
    • SOC 1
    • SOC 2
    • SOC 3
    • ISO 27001
    • ISO 27017
    • ISO 27018
    • PCI DSS Level 1

  • Cloudflare

    Hosting for the sites the platform publishes on a customer's behalf, DNS for branded and mail domains, and the transit of the Supabase platform logs, which carry email addresses and IP addresses, to the observability collector.

    Entity
    Cloudflare, Inc. (San Francisco, United States)
    Processing
    • Global edge network
    Transfers
    EU-US Data Privacy Framework, with the EU Standard Contractual Clauses applying where it does not.
    Retention
    Deletes or returns personal data at the customer's choice following termination.
    Certifications
    • SOC 2 Type II
    • ISO 27001:2022
    • ISO 27018:2019
    • ISO 27701:2019
    • PCI DSS Level 1

  • Daytona

    The sandboxes where agents run, covering uploaded documents, browser profiles, and secrets held in memory during a run.

    Entity
    Daytona Platforms Inc. (New York, United States)
    Processing
    • EU (the eu target)
    Transfers
    EU Standard Contractual Clauses (Module Two), per the DPA.
    Retention
    Returns or deletes client personal data on termination or on request.
    Certifications
    • SOC 2 Type 1
    • SOC 2 Type 2
    • ISO 27001
    • HIPAA

  • Supabase

    Primary database, authentication, file storage, and the projects the platform provisions for customers.

    Entity
    Supabase Pte. Ltd. (Singapore)
    Processing
    • EU (eu-central-1, Frankfurt)
    • Customer databases: the region the customer picks, Frankfurt by default
    Transfers
    EU Standard Contractual Clauses (Module Two), per the DPA.
    Retention
    Deletes all covered data after a 30 day retention period following expiry.
    Certifications
    • SOC 2 Type 2
    • ISO 27001
    • HIPAA

  • Vercel

    Hosting and server-side rendering for the web application and the public site.

    Entity
    Vercel Inc. (Delaware, United States)
    Processing
    • EU (fra1, Frankfurt, for rendering and functions)
    • Global edge (static assets and request routing)
    Transfers
    EU-US Data Privacy Framework, plus the EU Standard Contractual Clauses and the UK Addendum.
    Retention
    Deletes customer data on termination. Internal backups persist for 30 days.
    Certifications
    • SOC 2 Type 2
    • ISO 27001:2022
    • PCI DSS SAQ-D
    • TISAX AL2

Artificial intelligence models

See every model9 providers

  • Anthropic

    Language model inference, and the Claude engine running on the platform's subscription accounts.

    Entity
    Anthropic PBC
    Processing
    • US
    • EU
    • Asia
    • Australia
    Transfers
    Standard Contractual Clauses (SCCs) via the DPA.
    Retention
    API inputs/outputs deleted within 30 days by default; Zero Data Retention available by agreement.
    Certifications
    • SOC 2 Type I
    • SOC 2 Type II
    • ISO 27001:2022
    • ISO/IEC 42001:2023
    • HIPAA-ready

  • Google

    Gemini model inference, embeddings for search, optical character recognition, speech transcription and synthesis, and image, video and music generation.

    Entity
    Google LLC (Google Cloud EMEA Ltd for many EEA/UK customers)
    Processing
    • EU multi-region (vertex, for the models Google offers there)
    • Global (gla, and vertex models not offered in the EU)
    Transfers
    EU-US Data Privacy Framework (+UK, Swiss extensions) + SCCs.
    Retention
    Vertex AI: not used for training, ZDR-equivalent by amendment. Gemini API free tier may use data; paid tier does not.
    Certifications
    • ISO/IEC 27001
    • ISO/IEC 27017
    • ISO/IEC 27018
    • ISO/IEC 27701
    • SOC 1
    • SOC 2
    • SOC 3
    • EU-US DPF

  • Groq

    Inference for one open-weight model.

    Entity
    Groq, Inc. (Groq Limited for certain non-US regions)
    Processing
    • US (Google Cloud buckets)
    Transfers
    EU SCCs (2021/914), UK IDTA, Swiss FADP clauses.
    Retention
    Inputs/outputs not retained except to provide the service; up to 30 days for troubleshooting/abuse unless ZDR enabled; data stored in US GCP buckets.
    Certifications
    • SOC 2 Type II

  • Meta Model API

    Only if you enable it

    Inference for the Muse Spark models, when a workspace selects one of them.

    Entity
    Meta Platforms, Inc.
    Processing
    Not published by the vendor
    Transfers
    EU-US Data Privacy Framework (Meta Platforms, Inc. is certified for EU and Swiss transfers). No product-specific transfer terms are published for the Model API.
    Retention
    Not published by the vendor
    Certifications
    Not published by the vendor

  • Microsoft Azure OpenAI

    Only if you enable it

    Inference for the OpenAI models served from the EU data zone, for workloads that need processing inside the EU.

    Entity
    Microsoft Corporation
    Processing
    • EU (EU data zone: prompts and responses are processed in any EU member nation)
    • EU (data at rest stays in the resource's geography, including the abuse-monitoring store)
    Transfers
    Microsoft Products and Services Data Protection Addendum, which incorporates the EU Standard Contractual Clauses. An EU DataZone deployment processes the request inside the region, so inference is not a transfer.
    Retention
    Prompts and completions are not used to train or improve any model and do not reach OpenAI. Automated review stores nothing. A sample flagged by abuse monitoring can be stored for human review in the resource's geography, and for EEA deployments only employees located in the EEA review it. Approved modified abuse monitoring removes that storage and that review. The platform sends store=false, so the Responses API creates no message-history store in the resource.
    Certifications
    • ISO/IEC 27001:2022

  • OpenAI

    Model inference, document conversion, speech synthesis, image generation, realtime voice, and the Codex engine.

    Entity
    OpenAI, L.L.C. (OpenAI Ireland Ltd is controller for EEA consumers)
    Processing
    • US
    • EU
    Transfers
    EU SCCs + UK IDTA; regional data residency (US/EU) available.
    Retention
    Not used for training by default; abuse-monitoring logs up to 30 days; Zero Data Retention available. The platform sends store=false on every request, so no prompt or completion is kept in our OpenAI organization beyond that abuse-monitoring window.
    Certifications
    • SOC 2 Type 2
    • ISO/IEC 27001:2022
    • ISO/IEC 27017
    • ISO/IEC 27018
    • ISO/IEC 27701:2019
    • ISO/IEC 42001:2023
    • CSA STAR

  • OpenRouter

    Only if you enable it

    Gateway serving models from several authors, when a workspace selects one of them.

    Entity
    OpenRouter, Inc.
    Processing
    • US (OpenRouter)
    • EU (OpenRouter's European host, for the openrouter-eu models)
    • Varies by downstream provider
    Transfers
    EU SCCs and adequacy decisions.
    Retention
    No prompt/completion logging by default (metadata only); content stored only if logging is opted in (min 3 months); ZDR enforceable per-account/request.
    Certifications
    • SOC 2
    • ISO 27001

  • Vercel AI Gateway

    Only if you enable it

    Gateway serving models from several authors, when a workspace selects one of them.

    Entity
    Vercel Inc. (Delaware, United States)
    Processing
    • US (the gateway terminates the request in any Vercel region)
    • Varies by downstream provider unless the request pins a region
    Transfers
    EU-US Data Privacy Framework, plus the EU Standard Contractual Clauses and the UK Addendum.
    Retention
    The gateway retains no prompt or response content: it is deleted once the request completes. Per-attempt routing metadata is kept for 30 days. Zero data retention is requested per request, where the downstream provider supports it.
    Certifications
    • SOC 2 Type 2
    • ISO 27001:2022
    • PCI DSS SAQ-D
    • TISAX AL2

  • xAI

    Inference for the platform default model, realtime voice, and the web search worker.

    Entity
    X.AI LLC
    Processing
    • US
    • Other (subprocessors)
    Transfers
    EU Standard Contractual Clauses (Decision 2021/914).
    Retention
    Deleted on termination unless legally required; ZDR-Enabled API option retains no user content.
    Certifications
    • SOC 2 Type 2

Messaging channels

7 providers

  • Microsoft Azure AI Bot Service

    Only if you enable itAnnounced change · Effective November 14, 2026

    The bot behind our Microsoft Teams app: it carries messages, cards and files between the people of a customer's organization and its agent on the Teams channels a customer enables.

    Entity
    Microsoft Corporation
    Processing
    • EU (bot resource in West Europe with regional residency, inside the EU Data Boundary)
    Transfers
    Microsoft Products and Services Data Protection Addendum, which incorporates the EU Standard Contractual Clauses, and the EU-U.S. Data Privacy Framework, under which Microsoft Corporation is listed as active.
    Retention
    Not published by the vendor
    Certifications
    Not published by the vendor

  • Slack

    Only if you enable it

    The Slack channel and toolkit, plus our own operational alerting.

    Entity
    Slack Technologies Limited (Dublin, Ireland)
    Processing
    • US (default)
    • EU residency available (Germany, France, Sweden, Ireland)
    Transfers
    The Data Privacy Framework, the Standard Contractual Clauses, and Salesforce's processor Binding Corporate Rules.
    Retention
    Deletion follows the timeframes in the Security, Privacy and Architecture Documentation.
    Certifications
    • SOC 2 Type II
    • SOC 3
    • ISO 27001
    • ISO 27017
    • ISO 27018
    • ISO 27701
    • ISO 42001

  • Telegram

    Only if you enable it

    Bot API messaging for the Telegram channel.

    Entity
    Telegram Messenger Inc. (British Virgin Islands) and Telegram FZ-LLC (Dubai)
    Processing
    • EU (Netherlands, for accounts registered in the EEA)
    Transfers
    Not published by the vendor
    Retention
    Not published by the vendor
    Certifications
    Not published by the vendor

  • TikTok

    Only if you enable itAnnounced change · Effective November 14, 2026

    The comments and, where TikTok allows it, the direct messages of the TikTok business accounts a customer connects as a channel, read and answered through TikTok's API for Business.

    Entity
    TikTok Technology Limited (Dublin, Ireland)
    Processing
    • Not published for API for Business data
    Transfers
    The EU Standard Contractual Clauses (module two) in TikTok's jurisdiction specific terms for its business products data. No TikTok entity is listed under the EU-U.S. Data Privacy Framework.
    Retention
    Not published by the vendor
    Certifications
    Not published by the vendor

  • Twilio

    Only if you enable it

    SMS messaging, phone number provisioning, and voice call bridging.

    Entity
    Twilio Ireland Limited (Dublin, Ireland)
    Processing
    • US (default)
    • EU (Ireland, under Regional Twilio)
    Transfers
    The Data Privacy Framework first, then Twilio's Binding Corporate Rules, then the EU Standard Contractual Clauses, in that order of precedence.
    Retention
    Deletes stored customer content 30 days after termination, and backup copies within 60 days.
    Certifications
    • SOC 2
    • ISO 27001
    • ISO 27017:2015
    • ISO 27018:2019
    • PCI DSS v4.0.0

  • Unipile

    Only if you enable it

    LinkedIn messaging for the LinkedIn channel.

    Entity
    Unipile SAS (Riorges, France)
    Processing
    • EU (France, on Scaleway)
    Transfers
    None required. The processor is established in the EU and hosts exclusively in France.
    Retention
    Account data and technical data are deleted 30 days after deletion or collection.
    Certifications
    • SOC 2 Type II
    • CASA Tier II

  • WhatsApp and Meta messaging

    Only if you enable it

    WhatsApp Business, Instagram, and Messenger messaging for the channels a customer enables.

    Entity
    WhatsApp Ireland Limited and Meta Platforms Ireland Limited (Dublin, Ireland)
    Processing
    • EU (Ireland, Sweden, Denmark)
    • Other Meta data centres
    Transfers
    The Data Privacy Framework, with the Standard Contractual Clauses incorporated through the WhatsApp Business Data Transfer Addendum.
    Retention
    Messages are retained for a maximum of 30 days to provide the Cloud API.
    Certifications
    • ISO 27001 (Cloud API)

Voice

1 provider

  • ElevenLabs

    Only if you enable it

    The voice agent that speaks on calls when a channel or the Coordinator's voice is set to it.

    Entity
    Eleven Labs Inc. (New York, United States), with Eleven Labs Poland sp. z o.o. as the EU establishment
    Processing
    • US
    • EU (Netherlands)
    • Singapore
    Transfers
    EU-US Data Privacy Framework, with the Standard Contractual Clauses in the DPA.
    Retention
    Conversations are retained for two years by default and the period is configurable. A zero retention mode covers the speech endpoints on enterprise plans.
    Certifications
    • SOC 2 Type II
    • ISO 27001
    • ISO 27701
    • ISO 42001
    • FedRAMP 20x Class A
    • TX-RAMP Level 2
    • HIPAA (with a business associate agreement, enterprise only)

Tool connections

2 providers

  • Composio

    Only if you enable it

    OAuth broker and API proxy to the third-party tools a customer connects.

    Entity
    Sampark, Inc. dba Composio (San Francisco, United States)
    Processing
    Not published by the vendor
    Transfers
    EU Standard Contractual Clauses, Module Two and Module Three.
    Retention
    Logs are retained for zero days by default, and payload retention is configurable.
    Certifications
    • SOC 2 Type II
    • ISO 27001:2022

  • Pipedream

    Only if you enable it

    Second OAuth broker to the third-party tools a customer connects.

    Entity
    Pipedream, Inc. (Delaware, United States)
    Processing
    • US (us-east-1)
    Transfers
    EU Standard Contractual Clauses, included in the data protection addendum.
    Retention
    Execution details expire after 365 days.
    Certifications
    • SOC 2 Type 2

Billing and notifications

3 providers

  • OneSignal

    Push notifications and transactional email to workspace members.

    Entity
    OneSignal, Inc. (San Mateo, United States)
    Processing
    • EU (primary data centres)
    Transfers
    EU-US Data Privacy Framework, with the Standard Contractual Clauses where it does not apply.
    Retention
    Message data is deleted after 30 days. User data is retained on paid plans until deleted.
    Certifications
    • SOC 2 Type II
    • ISO 27001
    • ISO 27701

  • Resend

    Delivery of the authentication service's email: signup confirmation, invitations, password recovery and email change confirmation.

    Entity
    Plus Five Five, Inc., trading as Resend (San Francisco, United States)
    Processing
    • United States (storage)
    • Ireland (sending)
    Transfers
    EU Standard Contractual Clauses, with the EU-US Data Privacy Framework as an additional mechanism.
    Retention
    Keeps email content and logs for 30 days and its backups for 7 days. Deletes the data within 90 days of termination.
    Certifications
    • SOC 2 Type II

  • Stripe

    Subscription billing, credit purchases, and partner payouts through Connect.

    Entity
    Stripe Payments Europe, Limited (Ireland)
    Processing
    • US
    • India
    Transfers
    EU-US Data Privacy Framework, with the EEA Standard Contractual Clauses in the DPA.
    Retention
    Deletes or returns personal data at the customer's choice. Stripe retains merchant records for five or more years in its own controller capacity.
    Certifications
    • PCI DSS Service Provider Level 1
    • SOC 1 Type II
    • SOC 2 Type II

Observability and analytics

4 providers

  • GitHub

    Repository hosting for the arm that opens pull requests automatically.

    Entity
    GitHub, Inc. (San Francisco, United States)
    Processing
    • US
    Transfers
    EU-US Data Privacy Framework, with the Standard Contractual Clauses in the data protection agreement.
    Retention
    Retained while the account is active and as needed to meet contractual obligations.
    Certifications
    • SOC 1 Type 2
    • SOC 2 Type 2
    • ISO 27001:2022
    • CSA STAR Level 2
    • PCI DSS

  • Instatus

    The public service status page, its uptime monitors and the notices to whoever subscribes to it.

    Entity
    Instatus, Inc. (Beaverton, United States)
    Processing
    • United States
    Transfers
    The 2021 EU Standard Contractual Clauses incorporated in its DPA.
    Retention
    Purges deleted items and a cancelled account's data within 30 days, and its backups within 60.
    Certifications
    Not published by the vendor

  • Logfire

    Execution traces, which carry prompts and tool inputs and outputs once secrets are scrubbed, and the Supabase platform logs: the auth logs, which carry email addresses and IP addresses, the database logs, which carry query text, and the gateway, storage and realtime logs.

    Entity
    Pydantic Services Inc. (Delaware, United States)
    Processing
    • EU (Netherlands)
    Transfers
    EU Standard Contractual Clauses, with the UK International Data Transfer Addendum.
    Retention
    30 days on the current plans.
    Certifications
    • SOC 2 Type II

  • PostHog

    Product analytics and error tracking on the application and the public site.

    Entity
    PostHog, Inc. (San Francisco, United States)
    Processing
    • EU (eu-central-1, Germany)
    Transfers
    EU-US Data Privacy Framework, with the Standard Contractual Clauses in the DPA.
    Retention
    Events are retained for up to seven years on paid plans, and session replays for a shorter configurable window.
    Certifications
    • SOC 2 Type 2

Agent tooling

4 providers

  • Brave Search

    Only if you enable it

    Open web search and image search for the agent's search tools. It receives the search query text.

    Entity
    Brave Software, Inc. (Delaware, US)
    Processing
    • US (Amazon Web Services)
    Transfers
    Standard Contractual Clauses. Brave does not participate in the EU-US Data Privacy Framework.
    Retention
    Brave keeps the API search query log for up to 90 days for billing and troubleshooting. Zero data retention exists only on enterprise plans, which we do not use.
    Certifications
    • SOC 2 Type II

  • DataForSEO

    Only if you enable it

    Search engine result data for the search optimisation toolkit.

    Entity
    DataForSEO OÜ (Tallinn, Estonia)
    Processing
    • EU (Germany, Hetzner)
    • US (some processors)
    Transfers
    None required for the processor itself, which is established in the EU. Its onward transfers run on the Standard Contractual Clauses or adequacy decisions.
    Retention
    Data stored for more than 365 days is permanently deleted.
    Certifications
    Not published by the vendor

  • treg

    Only if you enable itAnnounced change · Effective November 6, 2026

    A catalog of external data for the agent's research tools: search results, social profiles and posts, and company and people records from third-party providers, through one relay. It receives each request the agent sends and passes it to the provider that serves it.

    Entity
    Superdesign, operator of treg.to (its terms are governed by Delaware law, United States)
    Processing
    • US (Oregon, on Render)
    • Varies with the provider serving each call
    Transfers
    The vendor relies on the Standard Contractual Clauses its own processors offer, outside any data processing agreement.
    Retention
    Its privacy policy states that request and response bodies pass through without being stored, while its agent guide describes answers served again from an archive of earlier calls. The call log (tool, method, path, status and time) is kept while the account exists.
    Certifications
    Not published by the vendor

  • Webshare

    Only if you enable it

    Rotating proxies carrying the agent's browsing traffic, engaged only where a workspace provisions a proxy resource.

    Entity
    Webshare Software Company (Walnut, California, United States)
    Processing
    Not published by the vendor
    Transfers
    The vendor's European notice refers to the Standard Contractual Clauses, outside any data processing agreement.
    Retention
    Not published by the vendor
    Certifications
    Not published by the vendor

Client tools and intermediaries

Applications you contract and authorise us to operate on your behalf are governed by your relationship with their providers. Intermediaries and providers contracted by VibeTasking that process data on our behalf remain subject to the subprocessor regime. Each third party’s role depends on its actual function.

Privacy · Terms