Last updated: September 2026
We use the following third-party services (sub-processors) to provide our platform. Each sub-processor processes data only for the purposes described below and is bound by data processing agreements.
| Service | Purpose | Data shared | Location |
|---|---|---|---|
| Stripe | Payment processing and subscription management | Email, billing information | United States |
| Resend | Transactional email delivery | Email address, email content | United States |
| PostHog | Product analytics (consent-gated) | Usage events, device info (anonymized) | United States / EU |
| Sentry | Error monitoring and performance tracking | Error context, environment info (no PII) | United States |
| AWS S3 / Cloudflare R2 | File storage for uploaded documents | Uploaded files (tenant-scoped paths) | Configurable (region-dependent) |
| Upstash | Rate limiting and caching (Redis) | IP addresses, rate limit counters | Configurable (region-dependent) |
| Inngest | Background job orchestration | Job metadata, event payloads (no direct PII) | United States |
| Lemon Squeezy | Alternative payment processing | Email, billing information | United States |
We will update this page when adding or removing sub-processors. If a change materially affects how personal data is processed, we will notify affected customers in advance per the terms of our Data Processing Agreement.
Several of these services can be replaced with self-hosted alternatives. PostHog offers a self-hosted deployment. Rate limiting can use in-memory storage instead of Upstash. AI inference can be self-hosted via vLLM. Contact us for details on reducing third-party data processing.