Subprocessors
Policy version 1.0 — effective September 3, 2026
This list reflects what the platform's configuration and code actually reference today, grouped by role. Providers marked optional or feature-gated are engaged only when explicitly configured or enabled. This is an operating list, not a certification: material changes are announced before they take effect.
Infrastructure and platform operations
| Provider | Purpose | Data categories |
|---|---|---|
| Vercel | Application hosting, CDN, and scheduled job execution for the web platform. | All platform data categories in transit; application logs. |
| Supabase | Managed authentication and PostgreSQL database hosting. | Account data, workspace configuration, conversations, messages, audit logs. |
| Upstash | Managed Redis for rate limiting, caching, session memory, and one-time action-token replay protection. | Transient operational data: cache entries, rate-limit counters (stored as digests), short-lived tokens. |
| Railway | Persistent runtime for the voice channel's WebSocket relay. Feature-gated: the voice channel is off by default. | Voice call control metadata and audio streams, only when the voice channel is enabled. |
| Pinecone | Vector index for knowledge base embeddings used in retrieval. | Embedded merchant knowledge content and retrieval metadata. |
| Sentry | Error monitoring and diagnostics. | Error reports with request context. |
| Stripe | Billing and subscription management. | Merchant billing details. No buyer conversation content is sent to billing. |
AI processing
Before any LLM processing, guardrails scrub sensitive data patterns such as card numbers, government IDs, phone numbers, and email addresses from message content.
| Provider | Purpose | Data categories |
|---|---|---|
| OpenAI | Primary LLM inference for triage, drafting, and responses; embeddings; voice-note transcription; realtime voice sessions. | Conversation turns and retrieved knowledge context after sensitive-pattern scrubbing. |
| Moonshot AI (Kimi) | Fallback LLM inference when the primary provider is unavailable or rate-limited. | The same categories as the primary provider, for the turns it serves. |
| Cohere | Second-stage reranking of retrieved knowledge chunks. | Retrieved text chunks and the customer query. |
| Z.ai (GLM) | LLM inference for isolated evaluation runs. Disabled unless explicitly configured; not used for customer traffic by default. | Evaluation scenario content only. |
| Anthropic | Optional experimental provider fallback path; inactive unless configured. | The same categories as other LLM providers, only when enabled. |
Delivery and notifications
Outbound transactional email is sent through the deployment's configured SMTP server, which the operator selects; inbound email retrieval uses the provider listed below.
| Provider | Purpose | Data categories |
|---|---|---|
| Resend | Inbound email retrieval for the email channel. | Inbound email content and metadata. |
| Telnyx | Voice and SMS telephony, and WhatsApp onboarding links. Feature-gated: engaged only when the telephony channel is enabled. | Call and SMS metadata; voice streams when the voice channel is enabled. |
| Twilio | Legacy SMS support for existing deployments; optional. | SMS metadata and content, only when enabled. |
| Slack | Delivery of SLA-breach and escalation alerts, and an optional merchant workspace integration. | Alert summaries; conversation context only if the merchant connects a Slack workspace. |
| Expo | Push notifications for the dashboard mobile app. | Device push tokens and notification payloads. |
Integration surfaces (data stays with the merchant's own provider account)
The platforms below are connected per merchant, under the merchant's own account and authorization scopes. They are integration surfaces the platform reads from and acts on — not subprocessors for buyer data, because the underlying store or account remains the merchant's own.
| Platform | Data relationship |
|---|---|
| Shopify | Commerce integration under the merchant's own store account: authorized order, product, return, and fulfillment data, plus approval-gated actions. |
| Salla | Commerce integration under the merchant's own store account, using the scopes the merchant authorizes. |
| Zid | Commerce integration under the merchant's own store account, using the scopes the merchant authorizes. |
| WooCommerce / WordPress | Commerce integration via the aserva plugin running on the merchant's own site; store data stays on the merchant's infrastructure. |
| Wix | Commerce integration under the merchant's own Wix account, using the scopes the merchant authorizes. |
| Zendesk | Optional ticket-sync integration with the merchant's own Zendesk account. |
| Meta (Messenger, Instagram DM, WhatsApp) | Messaging channels through the merchant's own Meta app, phone numbers, or managed WhatsApp bridge. |
| Google (Gmail) | Optional email channel connected through the merchant's own Google account OAuth. |
Related policies
How we respond to incidents, and what we retain and delete, are documented alongside this list.