Subprocessors
This page lists the third-party subprocessors we engage to deliver our services. It supplements our Privacy Policy and is updated at least 30 days before any material change.
We engage each subprocessor under a data processing agreement that includes obligations no less protective than those in our Privacy Policy. Where a subprocessor is located outside Indonesia, the transfer is governed by one of the mechanisms recognised under UU PDP Article 56 (adequate protection levels, contractual safeguards, or your explicit consent).
1. Cloud infrastructure
- Cloudflare, Inc. — edge network, Workers, Pages, R2, D1, Turnstile, Access, Email Service. Hosting region: global edge with origin in Singapore and Frankfurt. Privacy Policy.
- Amazon Web Services, Inc. — backup storage and compute for non-edge workloads. Hosting region: Singapore (ap-southeast-1) and Frankfurt (eu-central-1). Privacy Policy.
2. AI model providers
- OpenAI, L.L.C. — inference for default agent runtime. Region: United States. Configured under terms that prohibit training on customer data. Privacy Policy.
- Anthropic P.B.C. — inference for governance and audit workloads. Region: United States. Configured under terms that prohibit training on customer data. Privacy Policy.
- Google LLC (Gemini) — fallback inference. Region: United States. Privacy Policy.
- Mistral AI — fallback inference for European-region workloads. Region: France. Privacy Policy.
3. Messaging platforms
- WhatsApp (Meta Platforms Ireland Ltd) — primary messaging channel for Personal Agent and Multi-Agent Workspace. Region: Ireland / United States. WhatsApp message content is sent to Meta to deliver and receive messages on our behalf; Meta processes this data under its WhatsApp Privacy Policy and our Meta Business API Data Processing Addendum.
- Telegram Messenger LLP — alternative messaging channel. Region: United Kingdom / Netherlands / Singapore. Privacy Policy.
- Slack Technologies, LLC — Multi-Agent Workspace deployment on team Slack workspaces. Region: United States. Privacy Policy.
- Discord Inc. — Multi-Agent Workspace deployment on Discord servers. Region: United States. Privacy Policy.
- Microsoft Corporation (Microsoft Teams) — enterprise deployments on Teams tenants. Region: data residency per customer tenant. Privacy Statement.
4. Payment processors
- Stripe, Inc. — subscription billing and invoicing. Region: United States / Ireland. We do not store full card numbers; Stripe handles PCI-DSS scope. Privacy Policy.
5. Analytics
- Cloudflare Web Analytics — privacy-respecting, cookieless website analytics. No cross-site tracking, no advertising profile. Privacy Policy.
6. Email and document services
- Cloudflare Email Service — transactional email (account notifications, billing receipts). Privacy Policy.
- Google LLC (Google Docs / Google Drive) — optional workspace for AI Audit and Workshops document collaboration, only where the customer has authorised a Google Workspace integration. Privacy Policy.
7. Changes to this list
We update this list at least 30 days before adding a new subprocessor or replacing an existing one. Material changes are communicated by email to active subscribers and by a notice on the Privacy Policy page. To object to a new subprocessor, contact us at the address on the Privacy Policy contact section.
8. Contact
For questions about a specific subprocessor or to exercise your rights under UU PDP, contact us via the address on the Privacy Policy contact section.