Legal
Subprocessors
These are the providers that process customer data on our behalf. We tell customers at least 30 days before adding or replacing one.
Draft. Highlighted fields still need to be filled in, and the text should be reviewed by a lawyer before launch.
Current subprocessors
| Provider | Purpose | Location of processing | Transfer safeguard |
|---|---|---|---|
| Google Cloud (Google Cloud EMEA Ltd.) | purpose, e.g. application hosting | EU (region) | EU–US Data Privacy Framework, SCCs |
| Amazon Web Services EMEA SARL | purpose, e.g. database and backups | EU (region) | EU–US Data Privacy Framework, SCCs |
| OpenRouter, Inc. | Routing requests to AI models that generate answers and process write-ups | EU (in-region routing: prompts and responses do not leave the EU); account and usage metadata USA | SCCs (for metadata) |
| Stripe Payments Europe, Limited | Payments and invoicing | EU (Ireland) and USA | EU–US Data Privacy Framework, SCCs |
| email provider | Sending service emails | region | safeguard |
| Vercel Inc. | Hosting of the public website (not the application) | EU (Frankfurt); static content served from a global network | EU–US Data Privacy Framework, SCCs |
We send AI requests through OpenRouter’s EU in-region routing. Prompts and responses are decrypted and processed only in the European Union and are forwarded only to model endpoints located in the EU. If no EU endpoint is available for a model, the request fails instead of being sent outside the EU.
OpenRouter does not store the content of prompts or responses; it keeps only technical metadata about each request, such as token counts and latency. We use only model endpoints that do not train on your data and do not retain it after processing.
Google and Microsoft are not our subprocessors when you sign in with them. They act as independent controllers under their own terms.