Sub-processors
The companies that help us run Cloudesk and may process personal data while doing so.
The short version
- Hosting and database, payments (Razorpay, Stripe), email delivery, AI (Anthropic) and network security (Cloudflare).
- Optional providers are used only if enabled — no AI provider sees anything unless AI features are on.
- No advertising, analytics or data brokers.
This summary is for convenience. The full text below is what applies.
Contents
1.About this list
A sub-processor is a company we use to provide Cloudesk that may process personal data — including our customers' data — on our behalf. Each one is bound by a written agreement with data-protection terms at least as protective as our Data Processing Addendum, and receives only the data it needs for its task.
Several services are optional. A provider in the list below is used only if it is enabled for the Service; for example, if AI features are switched off, nothing is sent to an AI provider, and only one email delivery provider is used at a time. To find out which providers are enabled at the moment, use the details on our contact page.
2.Current sub-processors
| Provider | What for | Data involved | When used | Location |
|---|---|---|---|---|
| Cloud hosting and managed database provider | Running the application servers, the PostgreSQL database that stores all Service data, file storage and backups | All Service data | Always | The region chosen for this Service — ask us for details |
| Razorpay Software Pvt. Ltd. | Taking subscription payments (UPI, cards, net banking, wallets) | Name, email, invoice amount and reference; card and bank details are entered directly with Razorpay | When Razorpay payments are enabled and you pay with it | India |
| Stripe, Inc. and affiliates | Taking subscription payments by card | Name, email, invoice amount and reference; card details are entered directly with Stripe | When Stripe payments are enabled and you pay with it | United States, Ireland and other countries |
| Email delivery — one of Resend, Postmark (ActiveCampaign), Twilio SendGrid, or an SMTP relay | Delivering service emails: sign-in codes, invitations, invoices, reminders and notifications | Recipient email address, name, and the email content | Whichever single provider is configured | United States, or the relay's own location |
| Anthropic, PBC | AI features: the copilot, website builder assistant, reading bills and documents, drafting | The instructions you give and the content needed for that task | Only when AI features are enabled and you use one | United States |
| Voyage AI (part of MongoDB, Inc.) | Semantic search for the website chatbot and search (text embeddings) | Text of the content being indexed or searched | Only when semantic search is enabled | United States |
| Cloudflare, Inc. | Content delivery, DNS and network security in front of the Service, including blocking attacks | Request data such as IP address, headers and the page requested | When the Service is routed through Cloudflare | Global network; United States |
3.Services you choose to connect
These services are used only when you or your workspace connect them, and they act for you under their own terms rather than as our sub-processors:
- Mailboxes you connect to Mail — Google (Gmail, Google Workspace), Microsoft (Outlook, Microsoft 365) or any IMAP/SMTP server.
- Sign in with GitHub, and your organisation's own identity provider for single sign-on and SCIM.
- Publishing a site to GitHub, Netlify, Vercel or Cloudflare Pages.
- Payment accounts (Razorpay, Stripe, PayPal) that a business connects to take payments in its own store.
- An AI provider account whose API key a workspace adds for its own use.
4.Not currently used
OpenAI is listed in the app as a possible future AI provider, but it is not implemented and no data is sent to it. We use no advertising, analytics or data-broker services.
5.Changes and notifications
We update this page before a new sub-processor starts processing personal data. Customers who want advance notice by email can use the details on our contact page to be added to the notification list; under the DPA you then get at least 15 days to object.