Every control in the technical register carries a build-status label. Legal commitments remain as published: a missing test or an unavailable implementation status does not suspend a contractual commitment.
Subprocessors
Every third party that may process customer data, what it does, and where. Short by design: each addition is a new place your data can be, so we add them reluctantly.
Five vendors today: Microsoft Azure, Azure Communication Services, Polar, GitHub, and Anthropic. You get 30 days notice before we add any that handle session contents.
A summary is not the agreement. Where the two disagree, the clauses below govern.
1 Current list
Current list
Session contents means workspace data, checkpoints, and event ledgers. Account data means identity, contact, and billing information.
These are the vendors demonstrably in use today, regions as observed. Categories still without a chosen vendor (error monitoring, support desk) are added here, with notice, before any takes customer data.
| subprocessor | purpose | data and region |
|---|---|---|
| Microsoft Azure | hosting: the control plane, the session fleet, this site, and the leads store | session + account · Europe (observed) |
| Microsoft Azure Communication Services | transactional email: signup, receipts, alerts (the delivery gate) | account contact data · data location Europe |
| Polar | merchant of record: checkout, payment processing, purchase receipts (gate cp-c3) | billing data · card details never touch KeepState |
| GitHub | source hosting, CI, public client releases | no customer session data |
| Anthropic | model inference when you choose managed keys | session · via the metering gateway; BYOK routes to your own provider directly |
2 What is deliberately absent
What is deliberately absent
No analytics vendor by default, because the console works without one. No session recording tool, ever: replaying a customer’s screen is a category of access we have decided not to have. No data warehouse holding session contents for our own analysis.
3 Model providers
Model providers
When you use managed inference we route calls to model providers on your behalf. They are not listed as subprocessors of ours because you are choosing them: their terms apply to that call, and your ledger records which provider served it. Bring your own keys and the relationship is directly yours.
4 Notification
Notification
Additions are announced in the changelog and by email to Owners. Session-content subprocessors carry 30 days notice; account-data subprocessors carry 14. Removals are announced too, because a shorter list is worth telling you about.
Control status register
reg Control status register
technical register, not part of the agreement
Every control this document names, with the deployment state derived from the same capability source /security and /proof render. Implementation evidence is dated separately from the legal commitments above. Missing evidence does not amend those commitments; gaps require remediation and communication of customer impact.
| control | status | evidence |
|---|---|---|
| Published, versioned subprocessor list The versioned subprocessor list and its stated notice periods remain binding. The register is an editorial policy record, not a technical test. Evidence register dated 2026-10-23; current implementation not independently verified. The published commitment remains. | production state unavailable | none · plan, not proof |
Version history begins at v1.0, effective 2026-09-03; no earlier version exists. Material changes are announced 30 days before they take effect, by email to Owners and in the changelog.
v1.0 · effective 2026-09-03 · no prior versions