Subprocessor List
Last Updated: May 2026
The following subprocessors are engaged by PartnerAPI to process personal data on behalf of our customers. All subprocessors are bound by written data processing agreements.
<!-- SUBPROCESSORS:START (auto-generated from docs/gdpr/subprocessors.yaml — run pnpm subprocessors:generate after editing the YAML) -->
Infrastructure & Hosting
| Subprocessor | Purpose | Location | Transfer Mechanism |
|---|
| AWS (S3, SES) | Object storage, email delivery | EU (eu-west-1, eu-north-1) | N/A (EU) |
Monitoring & Observability
| Subprocessor | Purpose | Location | Transfer Mechanism |
|---|
| Sentry | Error tracking and monitoring | EU (Frankfurt) | N/A (EU) |
| Grafana Cloud (Loki) | Log storage and querying | EU | SCCs |
AI & Machine Learning
| Subprocessor | Purpose | Location | Transfer Mechanism |
|---|
| OpenAI | AI embedding generation, inference, and content moderation (partner-uploaded RAG document chunks) | US | SCCs + DPA |
| Chroma Inc. (Chroma Cloud) | Vector embedding storage for tenant document content (per-tenant collections used for AI knowledge retrieval) | US | SCCs + DPA (DPA review pending) |
| LangChain (LangSmith) | LLM run tracing and observability. Active only when LANGSMITH_TRACING_V2=true with a LANGSMITH_API_KEY present. When enabled, LangChain exports each agent run's full prompts and completions (including user queries and partner-uploaded RAG document chunks) plus run metadata (tenant_id, partner_id, and potentially user_id) to LangSmith's hosted US servers. | US | SCCs + DPA (Pending — DPA/SCCs review owed (PAPI-1910). Tracing is enabled by default in development only; production environments must keep LANGSMITH_TRACING_V2=false until a signed DPA + SCCs are on file. A startup guard in AgentService warns if tracing is enabled with NODE_ENV=production.) |
Communications
| Subprocessor | Purpose | Location | Transfer Mechanism |
|---|
| Mailjet | Transactional email delivery | EU (France) | N/A (EU) |
Billing & Payments
| Subprocessor | Purpose | Location | Transfer Mechanism |
|---|
| Stripe | Payment processing and billing | US/EU | SCCs + DPA |
Identity & Integrations
| Subprocessor | Purpose | Location | Transfer Mechanism |
|---|
| Atlassian (Confluence + OAuth) | OAuth identity provider; Confluence page content ingestion when the Controller enables the Confluence integration | US | SCCs (DPA review pending) |
<!-- SUBPROCESSORS:END -->
Changes to This List
We will notify customers of any changes to our subprocessor list at least 30 days before a new subprocessor begins processing personal data. Customers may object to the appointment of a new subprocessor as outlined in our Data Processing Agreement.
Contact
For questions about our subprocessors, contact us at: