Subprocessors

A subprocessor is a company we engage to process personal data on behalf of our customers as part of the ASDK service, for example to host the service or to run the AI models behind the agents. This page is the subprocessor list referred to in our Data processing addendum (Annex 3). It also lists the payment processor, which handles our customers' billing data.

Every subprocessor is bound by a written contract that requires it to protect the data at least as well as our DPA does and to use it only to provide its service to us. We remain responsible to our customers for our subprocessors.

Current subprocessors

Abbreviations: DPF means the EU-US Data Privacy Framework, together with its UK Extension and, where listed, the Swiss-US Data Privacy Framework. SCCs means the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), used together with the UK International Data Transfer Addendum for UK data. We checked each company's DPF status on the official Data Privacy Framework List on October 20, 2026.

Rows marked "to be confirmed" will be completed, with notice as described below, before the provider processes any data. If the AI gateway is run by a company already listed above, we will say so in its row.

Notes on the AI model providers

• "As configured" means that we choose which provider and model handles each task, such as generating answers or creating embeddings, and data for that task goes only to the providers we have configured. All three providers are listed so that we can switch between them to keep the service reliable.
• No training. Each provider processes our requests under terms that prohibit using the data to train its models: OpenAI states that API data is not used for training unless the customer opts in, Anthropic's commercial terms state that it may not train models on customer content, and Google's Gemini API terms state that prompts and responses on paid services are not used to improve its products. We use only Google's paid Gemini API services.
• Short-term retention by providers. Providers may keep requests for a limited time to detect misuse. OpenAI, for example, states that it keeps abuse-monitoring logs for up to 30 days by default.

What is not on this list

• Services you connect yourself. When you connect a CRM, a calendar, a webhook, Zapier, Make or another tool to your ASDK account, that service is your own provider, not our subprocessor. We send it data because you instructed us to, and its own terms apply.
• Features that are not available yet. Before we launch features that need new providers, such as Voice or visitor company identification, we will add those providers to this list with notice.

How we tell you about changes

• We will give at least 30 days' notice before a new subprocessor starts processing customer personal data. We do this by updating this page and by emailing the owner of every ASDK account.
• If you have a reasonable objection to a new subprocessor based on data protection, email [TBD: privacy contact email] within the notice period and explain why. We will work with you in good faith to resolve it, for example by explaining the safeguards in place or suggesting a configuration that avoids the subprocessor for your data. If we can't resolve the objection, you may close your account, or stop using the affected feature, before the change takes effect.
• When we stop using a subprocessor, we remove it from this page.
• We will not let a new subprocessor process customer personal data before it appears on this page and the notice period has passed.

Change history