Legal
Sub-processors
Everyone who processes customer data on our behalf, what they do, and where. This list is generated from the same register the code is checked against, so it cannot quietly fall behind what we actually run.
| Who | What they do for us | What they receive | Message content? | Status |
|---|---|---|---|---|
| Anthropic | model provider | The assembled drafting context: recent messages in the thread, selected facts, and the persona description. Sent for inference and not used for training. | Yes | Not in use yet |
| OpenAI | model provider | Every message and draft we embed for retrieval, and the assembled drafting context when Anthropic is unavailable and drafting fails over. Sent for inference and not used for training. | Yes | Not in use yet |
| Google Cloud (Pub/Sub) | cache and queue | Gmail change notifications for mailboxes the customer connected: the mailbox address and a history marker, delivered to a topic in our project. No message bodies, subjects or drafts. | No | Not in use yet |
| Fly.io | hosting | Runs the brain container. Message content passes through memory in transit; nothing is written to their disks. | Yes | Not in use yet |
| Vercel | hosting | Serves slyos.world. The web panel renders in the browser and calls the brain directly, so message content does not transit Vercel. | No | Not in use yet |
| Neon | database | The primary Postgres store: messages, drafts, contacts, facts, embeddings, encrypted channel credentials, events and the audit log. | Yes | Not in use yet |
| Amazon Web Services | object storage | Attachments, uploaded context-library files, and generated export archives. | Yes | Not in use yet |
| Upstash | cache and queue | Job payloads carry identifiers only, never message bodies. Rate-limit counters and socket presence. | No | Not in use yet |
| Postmark | email delivery | Account email only: the address, and the sign-in link or recovery notice being delivered. Never a customer message. | No | Not in use yet |
| Sentry | error tracking | Stack traces and request metadata. Message bodies, draft text and credentials are stripped before send by an allowlist, not a denylist. | No | Not in use yet |
| Stripe | payments | Billing email, card details entered directly into their form, and the plan. Card numbers never reach us. | No | Not in use yet |
| Apple Push Notification service | push notifications | A device token and a notification that names a channel and a sender initial. Never draft text, never a message body. | No | Not in use yet |
| Firebase Cloud Messaging | push notifications | A device token and a notification that names a channel and a sender initial. Never draft text, never a message body. | No | Not in use yet |