Subprocessors
Last updated: 5 October 2026
These are the third parties that process customer personal data on our behalf to provide the Service. Each is bound by a contract that limits its use of the data to providing its service to us. Services you connect yourself (for example your Google, Microsoft or Slack account) are not our subprocessors — you choose to send data to them.
| Provider | Purpose | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| Google Cloud / Firebase | Application hosting, database, authentication, file storage, scheduling and secrets management | All account and workflow data you store with us | UK (London) and EU (Netherlands, Belgium); sign-in service is global; some build and agent-runner infrastructure in the US | Google Cloud Data Processing Addendum with UK IDTA / Addendum to the EU Standard Contractual Clauses |
| Amazon Web Services | Cloud browser infrastructure that runs your cloud automations and stores session recordings and downloads | Pages your cloud browser visits, session recordings, saved browser profiles | United States (us-east-1) | AWS Data Processing Addendum with UK IDTA / Addendum to the EU Standard Contractual Clauses |
| Stripe | Payment processing and billing | Name, email, billing country, payment method (card details stay with Stripe) | United States / Ireland | Stripe DPA with UK IDTA / Addendum to the EU Standard Contractual Clauses; EU-US Data Privacy Framework and UK Extension |
| Resend | Transactional and service email (sign-in, billing, schedule and moderation notices) | Email address and the content of the email | United States | Resend DPA with UK IDTA / Addendum to the EU Standard Contractual Clauses |
| Pipedream When you connect or run a Connect Hub app | Powers Connect Hub app integrations | Connection tokens and the data the integration steps you configure send or fetch | United States | Pipedream DPA with UK IDTA / Addendum to the EU Standard Contractual Clauses |
| Google AI (Gemini) | AI model provider for chat, agents and automations | Prompts, files and screenshots you submit to AI features | United States / global | Google Cloud / Gemini API terms with UK IDTA / Addendum to the EU Standard Contractual Clauses |
| Anthropic | AI model provider (Claude models) | Prompts, files and screenshots you submit to AI features | United States | Anthropic Commercial Terms DPA with UK IDTA / Addendum to the EU Standard Contractual Clauses |
| OpenAI | AI model provider (GPT models) | Prompts, files and screenshots you submit to AI features | United States | OpenAI DPA with UK IDTA / Addendum to the EU Standard Contractual Clauses |
| fal.ai When you create a video with Wan, MiniMax or Kling, or use ElevenLabs voices, sound effects or music without your own ElevenLabs account | Runs AI video and audio models for media generation: Wan (Alibaba), MiniMax, Kling (Kuaishou) and ElevenLabs voices, sound effects and music | The prompt or script and any images, video or audio clips you supply to a video, voice, music or sound-effect request, and the generated file | United States (Features & Labels, Inc.); the model maker it runs the request for may process it in its own region | fal.ai Data Processing Addendum (31 July 2026) incorporating the EU Standard Contractual Clauses and the UK IDTA — being put in place |
| OpenRouter When you choose a Kimi model, or create a Seedance video (or a Wan video while fal.ai is unavailable) | Runs Kimi models on selected EU and US inference providers that keep no copy of your content and do not train on it — EU providers first (Inceptron, Nebius, Together AI, Fireworks AI, Baseten, DeepInfra, Parasail, Amazon Bedrock, Modal, CoreWeave, Crusoe, Decart, Novita AI, Inference.net and Wafer); for a Kimi model none of them serves yet (today Kimi K3.1 Pro), on Moonshot AI's own endpoint under OpenRouter's zero-data-retention terms; and routes AI video requests to the model maker: Seedance to ByteDance (BytePlus ModelArk) and, as a fallback route, Wan to Alibaba Cloud | Kimi: everything a Kimi model works on (prompts, files and, on agent features, screenshots of pages, e-mails and calendar entries). Video: the prompt and any images, video or audio clips you supply, and the generated video | United States (OpenRouter, Inc.); Kimi requests are processed by the providers named above in the EU or the United States (Kimi K3.1 Pro today: Moonshot AI in Singapore); Seedance requests are processed by BytePlus in Malaysia, Indonesia and/or the EU, and content its filters flag is kept by BytePlus for 180 days in Malaysia | OpenRouter Data Processing Agreement with the EU Standard Contractual Clauses (Module 2) and the UK Addendum (BytePlus: its Model Services terms, to be confirmed) |
| Moonshot AI Only when you choose a Kimi model that only Moonshot AI hosts (Kimi K3.1 Pro). Other Kimi models run on the EU and US providers listed under OpenRouter, never on Moonshot AI | Runs the Kimi models that only Moonshot AI hosts (today Kimi K3.1 Pro): normally through OpenRouter on its zero-data-retention terms, and on Moonshot AI’s own service only as a last resort when OpenRouter is busy or down | Everything that Kimi model works on: prompts and files, and on agent features screenshots of pages and of your screen, e-mails, calendar entries and documents it reads — which can include other people’s personal data | Singapore (Moonshot AI PTE. LTD.). Through OpenRouter it keeps no copy and does not train; on the last-resort direct route Moonshot AI’s own terms apply, which allow it to use this content to improve its services, including training its models | No data processing agreement between Prompteryx and Moonshot AI and no UK/EU transfer safeguard of ours (no Standard Contractual Clauses or IDTA); through OpenRouter it is OpenRouter’s sub-processor under OpenRouter’s terms. UK and EU data-protection rights may be hard to enforce there |
| TypeSafe | Provides our "Jev" decision model (classification of agent decisions and redacted Showcase posts) | The text it is given to classify; not permitted to train on your content | Outside the UK/EEA | DPA and transfer risk assessment in progress |
| Oxylabs Only when you choose a proxy location for the cloud browser | Residential proxy network | Your cloud browser's web traffic for that session | EU (Lithuania) | Within the EEA |
| 2Captcha Only when automatic CAPTCHA solving is on for a cloud browser run | CAPTCHA solving | The CAPTCHA challenge and the address of the page it appears on | Outside the UK/EEA | DPA and transfer risk assessment in progress |
Providers in smaller type are used only when you turn on the feature described.
Changes to this list
We update this page before a new subprocessor starts processing customer data. Business customers with a Data Processing Agreement receive advance notice as set out in that agreement. Questions: contact@prompteryx.ai.
See also: Trust & Security · Privacy Policy · Vulnerability disclosure