Subprocessors
Current subprocessors
Subprocessor — What it does for us — What it receives — Location
– Microsoft Azure — Cloud hosting for the whole platform: application services, database, file and document storage, and the vault holding our keys and credentials — All customer data, at rest and in transit through the hosted services — United States
– Anthropic — The AI model provider behind research, scoring, the assistant, and generated documents — Customer business content, sent in prompts on each agent run — United States
– OpenAI — Computes the numerical representations that make search and retrieval work and, when selected, performs scoped research beats with background polling and web search. — The text being indexed or matched; for selected research beats, scoped research prompts, market context and response data temporarily stored for background polling. — United States
– ElevenLabs — Speech-to-text and text-to-speech, where voice features are enabled — Voice audio and the reply text to be spoken — United States
– Cartesia — Secondary text-to-speech provider, used when the primary is unavailable — The reply or narration text to be spoken — United States
– Sentry — Error and diagnostic reporting, where enabled — Technical error reports, configured to exclude request contents, credentials, email addresses, and network addresses — United States
– GitHub — Source code hosting and the systems we use to build, test, and operate the platform — No customer business content — United States
– Microsoft 365 — Transactional account email (password recovery) via Microsoft Graph from the xs.global tenant — Recipient email address and message body — To be confirmed for the xs.global Microsoft 365 tenant
Not a subprocessor
Snowflake supplies market reference data to us. Data flows in one direction only, and no customer data is sent to it. It is registered and reviewed like any vendor, but it does not process customer data on our behalf and is therefore not a subprocessor.
Transfers
Several subprocessors are based in the United States. Where personal data is transferred out of the EU, the UK, or Switzerland, that transfer is made under the European Commission's standard contractual clauses with the applicable UK and Swiss addenda, or under an adequacy decision including the EU-US Data Privacy Framework where the provider participates in it, as recorded in each provider's agreement.
Changes to this list
We maintain this page as our current list. Additions are notified in advance under the DPA, and every change is recorded in /legal/changelog.