SaaSWish / Legal & trust
Sub-processors
Provider inventory for review. Actual regions, contracting entities and transfer safeguards must be confirmed by the operator before adopting a DPA. Code configuration alone does not establish data residency or an executed SCC.
| Name | Purpose | Data | Location | Transfer mechanism |
|---|---|---|---|---|
| Cloudflare | Hosting, containers, R2 storage and database backups | Account and session data, workspace files, database backups | Configured Cloudflare infrastructure; residency not established in this repository | Operator to confirm provider DPA and applicable SCCs or other valid safeguard |
| Anthropic | LLM inference | Prompts, selected repository context, tool results and messages sent for inference | Provider processing locations; operator to confirm | Operator to confirm provider DPA and applicable transfer safeguard |
| Stripe | Payment processing | Checkout/payment and billing identifiers; payment details entered with Stripe | Provider processing locations; operator to confirm | Operator to confirm applicable payment terms, roles and transfer safeguard |
| GitHub | Repository integration when connected | Repository content, pull requests and integration authorization data | Customer/provider configuration; operator to confirm | Customer/operator to confirm applicable terms and transfer safeguard |
| DuckDuckGo | Agent web search | Search queries submitted by the agent and request metadata | Provider processing locations; operator to confirm | Operator to assess applicable roles, terms and transfer safeguard |
| OpenAI (optional) | Embeddings for code indexing only when configured | Code text chunks submitted for embedding | Configured endpoint/provider locations; operator to confirm | Operator to confirm provider DPA and applicable transfer safeguard |
Configuration-dependent processing
Code indexing defaults to local hashed embeddings. OpenAI is used only when configured; an alternative OpenAI-compatible endpoint can be configured instead. Confirm that provider separately.
Slack, Linear, Jira and Microsoft Teams integrations are used only when the customer connects them. Customer-enabled MCP endpoints and other configured providers require a separate assessment of data sent and applicable terms.
Changes and questions
The proposed DPA includes advance sub-processor change notice. Contact the operator [CONTACT TO BE PROVIDED] to confirm the current contracted inventory and transfer arrangements.