Sub-processors
Last updated: to be set on publication
We use the following sub-processors to provide the GSAI Agent service. Each is bound by a written Data Processing Agreement. We notify customers 14 days in advance of any change to this list and grant a right of objection on reasonable data-protection grounds.
| Sub-processor | Role | Data | Location | Safeguard |
|---|---|---|---|---|
| Supabase Inc. | Database, authentication, file storage, edge functions | All account, configuration, encrypted secrets, audit and event logs | EU (Frankfurt) | EU-hosted; DPA signed |
| Stripe Payments Europe Ltd. | Payment processing, subscriptions, tax, invoicing | Name, billing address, country, VAT ID, payment metadata (no card numbers) | Ireland (EU entity) + Stripe US | EU contracting entity; Stripe intra-group SCCs |
| OpenAI Ireland Ltd. / OpenAI L.L.C. | LLM inference for the agent | Content the agent processes during inference | United States | EU–US Data Privacy Framework; OpenAI DPA; ZDR where supported |
| Google Ireland Limited | OAuth provider; Gmail and Calendar APIs | OAuth flow data; mailbox / calendar contents the agent reads or writes | EU + global Google infrastructure | OAuth client is yours; we hold only the refresh token you grant |
| Hostinger International Ltd. | VPS hosting of per-customer agent containers | Agent vault and transactional state, in-transit mailbox/calendar content | Vilnius, Lithuania (EU) | DPA signed |
| Resend, Inc. | Transactional email | Email address, transactional content (signup, billing receipts, etc.) | United States with EU edge | DPF; DPA signed |
| Telegram FZ-LLC | Bot messaging channel between you and your agent | Telegram chat ID, messages with bot | Global | You interact with Telegram under their Privacy Policy; we operate a Bot API client |
| Netlify, Inc. | Static hosting of the marketing site and portal | IP + request logs | US with EU edge | DPF; DPA signed |
Change history
Updated when sub-processors are added, removed, or changed.