Infrastructure
| Sub-processor | Purpose | Location |
|---|---|---|
| Vercel Inc. | API, dashboard and website hosting | United States (US East) |
| Neon, Inc. | Control-plane database | United States (US East) |
| Cloudflare, Inc. | Storage of the encrypted nightly database copy (ciphertext only; we hold the key) | European Union |
| GitHub, Inc. | Runs the nightly backup job; the database dump exists unencrypted on the job's runner for the minutes it takes to encrypt and upload it | United States |
| Resend, Inc. | Email to account holders (address and message only) | United States |
| WorkOS, Inc. | Dashboard sign-in (name and verified email address of the people who sign in) | United States |
| Functional Software, Inc. (Sentry) | Error reports from our own code; no request bodies or customer content | United States |
| Stripe Payments Europe, Ltd. | Payment and invoicing (billing data only; no trace data) | Ireland / United States |
Model providers are not sub-processors
We send nothing to model providers. Every call to one, a shadow call included, is made by the Software in your infrastructure, with your key, to a model on your allowlist, under your own agreement with that provider (§6). The allowlist is part of the routing policy you publish.
The current list is maintained at https://ergoda.com/legal/subprocessors. We
give 30 days' notice by email before any change.