Browse the docs
Privacy and security
Subprocessors and your data
Which providers help ASDK run your agents, what each one handles and where, how you're told about changes, and which services you connect yourself instead.
Last updated
On this page
A subprocessor is a company ASDK uses to process data on your behalf, for example to host the service or to run the AI models behind your agents. If your company has a data protection review, the list of subprocessors is usually one of the first things it asks for. The official list is our subprocessors page, which is part of the Data processing addendum. This page summarizes it and explains what it means for you.
Who does what
| Provider | What it does for ASDK | Data it handles |
|---|---|---|
| Vercel | Hosts asdk.com and the dashboard | Dashboard data, request data such as IP addresses |
| Cloudflare | Delivers the widget script, protects against attacks, stores uploaded files | Request data, traffic between the widget and ASDK, uploaded files |
| Pinecone | The vector database behind your knowledge, one namespace per site | Passages of your content and their search data |
| OpenAI, Anthropic, Google | AI models that write answers and make content searchable, as configured | Visitors' questions, relevant passages of your content, generated answers |
| Resend | Sends emails such as sign-in links and lead notifications | Recipients' names and addresses, email content |
| Sentry | Error monitoring | Technical error data |
The list also names three providers still to be confirmed: an AI gateway that routes requests to the model providers, the server hosting provider for the API and database, and the payment processor. Each will be named, with notice, before it processes any data.
Locations and the legal safeguards for transfers, such as the EU-US Data Privacy Framework or Standard Contractual Clauses, are listed for each provider on the subprocessors page.
Why three AI model providers
"As configured" means ASDK chooses which provider handles each task, such as writing answers or making content searchable, and data for that task goes only to the providers configured for it. All three are listed so ASDK can switch between them to keep your agents answering if one has an outage.
Each of them processes requests under terms that don't allow training their models on the data. See No training on your data.
How you're told about changes
- 30 days' notice. Before a new subprocessor starts processing customer personal data, the subprocessors page is updated and the owner of every ASDK account gets an email, at least 30 days ahead.
- You can object. If you have a reasonable data-protection objection to a new subprocessor, email us within the notice period with your reasons. We'll work with you to resolve it; if we can't, you can close your account or stop using the affected feature before the change takes effect.
- Removals are reflected on the page when we stop using a provider.
The page keeps a change history with versions and effective dates.
Services you connect are not subprocessors
When you connect a tool to ASDK yourself, such as a CRM, a calendar, a Slack channel, a webhook, Zapier or Make, that service is your own provider. ASDK sends it data because you told it to, and the service's own terms apply. Check those services in your own review.
The same goes for code on your website that passes data from the widget elsewhere, for example a lead event handler that sends data to your tag manager.
What to put in your own records
If your company keeps a record of processing activities or a vendor list, these details usually cover ASDK:
- Vendor: ASDK, as processor for your website chat and lead capture.
- Contract: our Data processing addendum.
- Sub-processors: the subprocessors page.
- Data: see Data we store.
- Retention: see Data retention.
- Security: our security page.
For a security questionnaire or a signed copy of the DPA, write to hello@asdk.com.
Related: AI disclosure to visitors.