Sub-processors
Every third party that touches data on our behalf, what it receives, and where it runs. This page forms part of our Data Processing Addendum.
Contents
Current sub-processors
These providers support the service. Customer Personal Data processing is governed by our Data Processing Addendum. Provider roles differ: payment and identity providers may also act as independent controllers for their own purposes. Last updated 23 October 2026.
| Sub-processor | Purpose | Data received | Location |
|---|---|---|---|
| Amazon Web Services (EC2, S3, Bedrock, Transcribe) | Hosts the API gateway, control-plane services, and every per-project engine container and its graph volume; encrypted off-host backups of project graphs; the chat models behind agents; meeting transcription. | All Customer Content; account identifiers; audio you record for transcription. | European Union — Frankfurt (eu-central-1) |
| Microsoft Azure OpenAI Service | Fact extraction, compilation, and answer synthesis (gpt-5.4-mini, gpt-5.4), inside the EU Data Zone. | Memory content submitted for processing; query text. | European Union — Sweden Central |
| Microsoft Azure OpenAI Service (Speech-to-Text) | Transcribing uploaded audio files (whisper). Separate resource because the model has no deployable EU SKU. | Audio files you upload. | United States — East US 2 |
| Microsoft Azure Blob Storage | Secondary encrypted disaster-recovery copies of project-graph backups. | Customer Content contained in backup snapshots. | United States |
| Neon (Postgres) | Control-plane database: accounts, sessions, organisations, billing, audit records, optional site analytics, connector records and team or agent chat. | Account and billing data; chat messages and associated customer content; connector records; audit and consent records; optional site measurement events. | European Union — Frankfurt (AWS eu-central-1) |
| Vercel | Hosts the Console web application and proxies browser traffic to our API. | Web requests, IP addresses and request metadata; account data and customer content passing through web or API routes. | United States / global edge |
| Cloudflare | TLS termination, DDoS protection, and reverse proxy for api.enkeon.com. | All API traffic in transit, including IP addresses at the edge. | Global edge network |
| Stripe | Payment processing and hosted checkout. | Billing email, subscription and invoice records, payment details you enter directly with Stripe. | United States |
| Resend | Transactional email: verification codes, password resets, service alerts. | Email address and message content. | United States |
| Google Analytics | Optional public-site audience measurement, enabled only after analytics consent. | Page and referring-site information, browser and device information, approximate geography and analytics identifiers. Private application routes are excluded. | Google infrastructure, including the United States |
| Google, GitHub | Optional single sign-on and connector authorisation initiated by you. | Provider identifiers, profile email and username; permissions and content accessed through connectors you authorise. | Per provider |
“Customer Content” includes project knowledge, documents, conversations and media submitted through enabled features. The control-plane database also holds chat and connector records; it is not limited to account and billing data. Global edge processing and US backups mean this list must not be read as an EU-only residency guarantee.
Who is deliberately not on this list
A sub-processor list is only useful if it is exhaustive, so it is worth naming the services we use that never receive your data — and why they are not listed.
- No embedding or reranking vendor. These models run as local files inside our own engine. Every memory you store is embedded and ranked on our infrastructure, so no third party receives your memory text in order to index it.
- Klavis AI. Our connector servers are built from their open-source images, but we host them ourselves on a private network. No data reaches Klavis the company.
- Cloudflare AI Gateway. It is supported in our configuration but not enabled. Model requests go directly to Azure, so no prompt or completion transits it.
We do not train or fine-tune models on Customer Content. Model requests use business API services; provider retention, abuse monitoring and transfer terms must be checked for the relevant deployment. This list is not a certification or a zero-retention guarantee.
Notice of changes
We give at least 30 days' notice before a new sub-processor begins processing customer data. To receive those notices, email [email protected] with the subject “Subscribe to sub-processor notices”. We will add you to the list and confirm.
We may engage a replacement sub-processor without the full notice period where an existing one becomes unavailable and continuity of service requires it. We will tell you as soon as we can, and your right to object is unaffected.
Objecting to a sub-processor
If you have reasonable data-protection grounds to object to a new sub-processor, tell us within the notice period. We will work with you in good faith to find an alternative. If we cannot, you may terminate the affected part of the service and receive a pro-rata refund of prepaid fees — you will not be held to a contract whose data flows you object to.
We keep every previous version of this document. If you need the text that was in force on a particular date, write to [email protected] and we will send it.