Legal
Subprocessors
The third parties that process data on our behalf, what each one handles, and where it runs.
Last updated 15 August 2026.
Who processes what
Categories rather than named vendors, because the specific providers are subject to change and a list that goes stale is worse than one that is honest about its granularity. Ask and we will name the current set for a data processing agreement.
| Category | What it handles | Data involved |
|---|---|---|
| Cloud infrastructure | Compute, databases, object storage, networking | All stored data |
| Language model provider | Entity extraction and answer synthesis | Document text and queries, at request time |
| Embedding provider | Vector generation for chunks and queries | Document text and queries, at request time |
| Identity provider | Authentication, sessions, directory sync | Account data — names, emails, organisation membership |
| Workflow orchestration | Durable step execution for the ingest pipeline | Job metadata and document identifiers |
| Email delivery | Invitations and transactional mail | Names and email addresses |
Model providers specifically
Worth calling out because it is the transfer people most want to understand. Document text is transmitted to a model provider at ingest, for extraction, and query text plus retrieved passages are transmitted at search time, for synthesis. Both are inference calls under terms that exclude training on API inputs. Neither retains your content for their own purposes.
Changes
We will update this page when the set changes materially, and will notify account administrators where a change affects the categories above.