$ cat SUBPROCESSORS.md
Subprocessors
Third-party service providers that process personal data on behalf of Kommit AI. We select providers with strong data protection practices and maintain Data Processing Agreements with each.
| Subprocessor | Purpose | Data Processed | Location |
|---|---|---|---|
| Anthropic | Model calls made by workflows and the canvas assistant | Workflow inputs, prompts, and outputs | United States |
| OpenAI | Model calls made by workflows; text embeddings for knowledge-base retrieval | Workflow inputs, prompts, outputs, and knowledge-base documents | United States |
| Hetzner | Application hosting (servers + deployment via Dokploy) | All application data in transit and at rest on application servers | Germany (EU) |
| Microsoft Azure Blob Storage | File storage for EU workspaces (uploads, knowledge-base documents) | Uploaded files | Netherlands (EU) |
| Vercel Blob | File storage for US workspaces (uploads, knowledge-base documents) | Uploaded files | United States |
| PostHog | Product analytics & error tracking | Usage events, user identity | European Union (Frankfurt) |
| Google Analytics | Consent-gated web analytics | Page URLs, device data, usage events | United States |
| GitHub | OAuth authentication, repository integration | Auth tokens, repository code | United States |
| Stripe | Payment processing | Billing information, email | United States |
| Langfuse | AI observability & tracing | AI request traces, token usage | European Union (Germany) |
| Botcruncher | Bot detection & ad fraud prevention | Traffic patterns, IP metadata, behavioral signals | European Union |
Last updated: May 30, 2026
We will update this page when subprocessors change and notify affected customers by email at least 30 days in advance of any new subprocessor being engaged.
Questions? Contact us at privacy@getkommit.ai