Sub-processors
Sub-processor list
Every third-party we route customer data through, grouped by role. We notify customers of additions or removals 14 days before they take effect.
Last updated 2026-05-16
Infrastructure
HostingEdge
| Vendor | Purpose | Region | Data |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting, object storage, secrets management. | US-East-1, EU-Central-1 | All processed data, encrypted at rest. |
| Cloudflare | Edge proxy, DDoS protection, bot management. | Global edge | Request metadata, IP, headers. |
| Neon / Postgres host | Managed primary database (pgvector enabled). | US-East-1 or EU-Central-1 per workspace. | Catalog data, conversation logs, account data. |
| Upstash | Edge rate-limiting + Redis primitives. | Multi-region. | Request identifiers (IP, store id), no PII bodies. |
AI model providers
LLMEmbeddings
Customer data sent to AI providers is not used to train base models. We use enterprise APIs with zero-retention or short-retention modes wherever available.
| Vendor | Purpose | Region | Data |
|---|---|---|---|
| OpenAI | Chat completion + embeddings (1536-dim). | US. | Prompt content + retrieved context. No training on customer data. |
| Anthropic | Alternate chat model for routing failover. | US. | Same as OpenAI scope. |
| Google AI (Gemini) | Alternate chat model. | US. | Same as OpenAI scope. |
| Azure OpenAI | Enterprise model routing on request. | EU / US (customer-selectable). | Same as OpenAI scope. |
Communications
EmailSMS
| Vendor | Purpose | Region | Data |
|---|---|---|---|
| Resend / SendGrid | Transactional email delivery. | US / EU. | Recipient email, subject, body, send metadata. |
| Twilio | SMS + WhatsApp delivery. | Per customer routing. | Phone number, message content, delivery receipts. |
| Slack (operational) | Internal incident + support routing. | US. | Operational notifications; PII never sent to channels by policy. |
Observability & billing
| Vendor | Purpose | Region | Data |
|---|---|---|---|
| Sentry | Error monitoring + performance traces. | US. | Stack traces, redacted request bodies. PII scrubbed before send. |
| Stripe | Subscription billing. | Global Stripe regions. | Billing email, card details (PCI-compliant), tax ID. |
Subscribe to updates
Want sub-processor change notifications?
Email legal@zubbyai.com with your workspace ID and we'll add you to the change-notice list.