Legal · last updated 2026-06-30
Subprocessors
These are the third-party providers AegisRail, operated by Eastbase Studio, uses to deliver the Service. Providers marked Required run for every customer. Providers marked Optional run only when the related feature is enabled or configured.
Practical template pending legal review. Not legal advice.
How To Read This List
Hosting, database, and billing are required to run the Service. Email, error monitoring, analytics, AI eval providers, and integrations are optional: they process data only when you enable the related feature or accept analytics. AI eval providers receive content only for workspaces that turn on model-graded evals.
Current Subprocessors
| Provider | Purpose | Data processed | Status | Region / hosting | Privacy |
|---|---|---|---|---|---|
| Vercel | Application hosting, serverless functions, scheduled jobs, CDN | Account, workspace, and request metadata; deployment and runtime logs | Required | Global edge | Privacy |
| Neon | Managed PostgreSQL database | Workspace, user, trace metadata, eval, incident, evidence, billing, and audit records | Required | Configured region | Privacy |
| Lemon Squeezy | Billing and merchant of record | Name, email, billing identifiers, and transaction data | Required for paid plans | Vendor-managed | Privacy |
| Resend | Transactional and notification email | Recipient email address and message content | Optional (when configured) | Vendor-managed | Privacy |
| Sentry | Error monitoring and diagnostics | Redacted error events, route names, and release information | Optional (when configured) | Vendor-managed | Privacy |
| PostHog | Product analytics | Masked product events, page views, and usage metadata | Optional (analytics consent) | United States | Privacy |
| Vercel Web Analytics | Aggregate, cookieless traffic measurement | Aggregate page and route metrics | Optional (analytics consent) | Global edge | Privacy |
| Google (Gemini API) | Model-graded eval execution | Eval cases and rubric content you submit | Optional (when enabled) | Vendor-managed | Privacy |
| OpenAI (API) | Model-graded eval execution | Eval cases and rubric content you submit | Optional (when enabled) | Vendor-managed | Privacy |
| BurnCap | AI cost and usage monitoring | AI usage and cost metadata; no prompts or completions | Optional (when configured) | Vendor-managed | Privacy |
| Slack | Incident and alert webhook delivery | Notification content you configure | Optional (customer-configured) | Vendor-managed | Privacy |
| Cloudflare | DNS, TLS, CDN, and WAF for a custom domain front door | Network request metadata | Optional (when configured) | Global edge | Privacy |
Changes To This List
We update this list as our providers change. Where a change to a subprocessor that processes Customer Personal Data is material, we will make a reasonable effort to give notice through the product so you can review it.