# Sageros - Sub-processors

*Last reviewed: 2026-08-05*

Sageros uses the third-party services listed below to run the platform. Each
one is bound by contractual data-protection terms - the DPA link in the
right-hand column is the sub-processor's own public Data Processing Addendum
that governs how they handle personal data on our behalf.

We give reasonable notice before adding a material new sub-processor.
Enterprise customers can subscribe to change notifications by emailing
`office@sageros.com`.

## Always-on sub-processors

These process data for every Sageros tenant on every request.

| Legal entity | Purpose | Data region | DPA |
|---|---|---|---|
| Supabase, Inc. (Delaware) | Managed Postgres database, authentication, storage | EU (Frankfurt) / US (Virginia) - per project | [supabase.com/legal/dpa](https://supabase.com/legal/dpa) |
| Railway Corp. (Delaware) | Application hosting for the API gateway | US (Virginia) | [railway.com/legal/dpa](https://railway.com/legal/dpa) |
| Vercel Inc. (Delaware) | Static hosting and edge delivery for the marketing site (`sageros.com`) | Global edge; primary US | [vercel.com/legal/dpa](https://vercel.com/legal/dpa) |
| Cloudflare, Inc. (Delaware) | DNS, DDoS protection, WAF, CDN | Global edge | [cloudflare.com/cloudflare-customer-dpa](https://www.cloudflare.com/cloudflare-customer-dpa/) |
| Resend, Inc. (Delaware) | Transactional email (lead notifications, lifecycle emails) | US | [resend.com/legal/dpa](https://resend.com/legal/dpa) |

## Conditional sub-processors

These process data only when a specific feature is used. Where the choice is
yours, opting out means the sub-processor never sees any data.

| Legal entity | When engaged | Data region | DPA |
|---|---|---|---|
| Google LLC | Sign-in with Google - only for accounts that choose Google OAuth | US | [cloud.google.com/terms/data-processing-addendum](https://cloud.google.com/terms/data-processing-addendum) |
| GitHub, Inc. | Sign-in with GitHub - only for accounts that choose GitHub OAuth | US | [github.com/customer-terms/github-data-protection-agreement](https://github.com/customer-terms/github-data-protection-agreement) |
| Google LLC (Google Analytics 4) | Aggregate marketing-site analytics with IP anonymization; **marketing pages only**, never the panel | US | [business.safety.google/adsprocessorterms](https://business.safety.google/adsprocessorterms/) |
| OpenAI, LLC | Upstream AI provider - only engaged when your agent's model choice routes to OpenAI (for example `gpt-4o-mini`). Sageros itself does not store prompts or completions; OpenAI's own retention policy applies to the request it receives from your agent. | US | [openai.com/policies/data-processing-addendum](https://openai.com/policies/data-processing-addendum/) |
| Anthropic PBC | Upstream AI provider - only engaged when your agent's model choice routes to Anthropic (for example Claude Haiku). Same content-handling note as OpenAI. | US | [anthropic.com/legal/aup](https://www.anthropic.com/legal/aup) |
| Stripe, Inc. | Payment processing - engaged only when you subscribe to a paid plan (paid plans not yet enabled) | US | [stripe.com/legal/dpa](https://stripe.com/legal/dpa) |

## Notes on the AI provider rows

Because Sageros is built to see numbers, not conversations, our own storage
never contains prompts or completions. The AI provider (OpenAI, Anthropic, or
whoever your agent talks to) still receives the full request from your agent
under their own terms and retention policy - Sageros is not in the storage
chain for that content. The DPA links above are for the direct customer-
provider relationship you already have; we list them here for transparency,
not because we relay content to them on your behalf.

## Notes on regions

- **Supabase**: the region is chosen at the Sageros project level. Our
  production project is currently on US East. EU-only residency is available
  on Enterprise plans - contact us.
- **Railway** and **Cloudflare**: US-primary but edge-cached globally.
- **Vercel** static assets are cached at global edges; no personal data is
  stored in Vercel beyond standard access logs.

## Change history

- **2026-08-05** - Added Resend (transactional email), OpenAI, Anthropic,
  Vercel. Reconciled with `security.html` and `privacy.html` section 7.
- **2026-07** - Initial list published (Supabase, Railway, Cloudflare, Google
  OAuth, GitHub OAuth, Google Analytics, Stripe).