Subprocessors
Every third party this system sends data to, what each one receives, and where. Model providers are on this list, because a prompt is customer data and we are the ones sending it.
Effective 2026-09-07 (last verified against the code)This list is incorporated into the Data Processing Addendum. We give at least 30 days' notice before adding to it. To be notified, write to susmit@vectorbea.com.
1Infrastructure
| Subprocessor | What it does | What it receives | Where |
|---|---|---|---|
| Vercel Inc. | Hosts the web application and its API routes. | Everything a signed-in user's browser sends and receives: account identifiers, workspace contents, and request logs. | United States, with edge points of presence worldwide |
| Railway Corp. | Runs the API and worker services. | Workflow definitions, run state, event payloads and connection secrets in encrypted form, for as long as a request is being served. | United States |
| Neon Inc. | Managed Postgres — the durable store for every run. | Workflows, versions, runs, events, spans, payloads, approvals, audit rows, and AES-256-GCM ciphertext for connection secrets. This is the primary data store. | United States |
| Upstash Inc. | Managed Redis — the run queue and the cache. | Queue messages naming a run, workspace and version. Cached API responses, which can include workflow and run metadata. Short-lived. | United States |
| Supabase Inc. | Authentication — sign-in, sessions and password reset. | Email address, hashed credential, session tokens and sign-in metadata. | United States |
2Model providers
A model call sends the assembled prompt — which contains whatever your workflow put in it — to the provider. The request is made from our infrastructure, so the provider is our subprocessor and is named here. Because it is made with the API key YOU supplied, your own agreement with that provider governs retention and training.
| Subprocessor | What it does | What it receives | Where |
|---|---|---|---|
| OpenAI, L.L.C. | Executes model calls for agent and model-call steps. | The assembled prompt — which contains whatever the workflow put in it, including the run's input — and the model's response.Reached with the API key you supply on a connection. Your agreement with OpenAI governs retention and whether your data may be used for training; ours does not override it. | United States |
| Anthropic PBC | Executes model calls for agent and model-call steps. | The assembled prompt and the model's response.Reached with the API key you supply on a connection. Your agreement with Anthropic governs. | United States |
| Google LLC (Gemini API) | Executes model calls for agent and model-call steps. | The assembled prompt and the model's response.Reached with the API key you supply on a connection. Your agreement with Google governs. | United States |
| Mistral AI SASOnly when you create a Mistral connection. | Executes model calls where a Mistral connection is configured. | The assembled prompt and the model's response.Reached with the API key you supply on a connection. Your agreement with Mistral governs. | France |
| Any provider you point a custom connection at | A model connection accepts a base URL, so a self-hosted or third-party OpenAI-compatible endpoint can be used instead of the providers above. | The assembled prompt and the response, sent to the host you named.We cannot name this one for you, and we do not control it. It is listed so the list is complete rather than convenient. | Wherever you point it |
3Communications
| Subprocessor | What it does | What it receives | Where |
|---|---|---|---|
| Resend, Inc. | Sends transactional email — sign-in, invitations, alerts, and the built-in email step in a workflow. | Recipient address, subject and body. For a built-in email step, the body is whatever the workflow put in it. | United States |
4Observability
| Subprocessor | What it does | What it receives | Where |
|---|---|---|---|
| Your OpenTelemetry collectorOff unless you configure an export AND the deployment has OTEL_TRACE_EXPORT_ENABLED set. It is off by default. | Receives exported run spans, if you configure an export. | Span names, timings, statuses and attributes for runs. Not payload bodies. | Wherever your collector runs |
5What is not on this list
Any system YOU connect — a database, an HTTP API, an MCP server — receives whatever your workflow sends it. Those are not our subprocessors: you chose them, you hold the credentials, and we have no relationship with them. They are your subprocessors, and belong on your own list.
Third-party analytics, advertising and session-replay services. We use none, on the product or on the marketing site. The product does record its own product-usage events — which page was opened, which feature was used — but those go to our own systems, not to a vendor, and the client is forbidden from sending prompt content or model output. That is first-party processing covered by the Privacy Policy, not a subprocessor.