Sub-processors.
The third parties OpenWPAgent uses to deliver the product. We email customers 30 days before adding a new sub-processor. To subscribe to changes, email dpa@openwpagent.com.
| Sub-processor | Role | Location | Data | Cert |
|---|---|---|---|---|
| Supabase ↗ | Database, auth, vector store, file storage | us-east-1 (US East) | Org data, agent runs, encrypted credentials, brain knowledge graph | SOC 2 Type II, HIPAA |
| Vercel ↗ | Dashboard hosting, edge functions | Global edge network (US/EU) | API requests, session cookies, deployment logs | SOC 2 Type II |
| Stripe ↗ | Payment processing, subscription billing, customer portal | Global (PCI Level 1) | Billing email, payment method, billing address, tax data | PCI DSS Level 1, SOC 2 Type II |
| Resend ↗ | Transactional email (license delivery, alerts, invites) | us-east-1 | Recipient email, message content | SOC 2 Type II |
| Trigger.dev ↗ | Agent scheduling, durable execution, retry queues | Global (multi-region) | Agent run inputs/outputs, error logs | SOC 2 Type II |
| Anthropic ↗ | Claude models (when customer brings Anthropic key) | Global | Prompts + completions sent at runtime; not retained for model training | SOC 2 Type II |
| OpenAI ↗ | GPT-4o models (when customer brings OpenAI key) | Global | Prompts + completions sent at runtime | SOC 2 Type II |
| Google ↗ | Gemini models, Search Console, Google Ads (when customer brings keys), Google Analytics 4 on the marketing site | Global | Prompts + completions; aggregated traffic + ad metrics; marketing-site page views (no form input, no query strings) | SOC 2 Type II, ISO 27001 |
| Meta ↗ | Advertising measurement — marketing-site pixel and server-side Conversions API | Global | Marketing-site page views and checkout starts; on purchase, the amount plus a SHA-256 hash of the buyer's email (never the address itself). Marketing site only — no dashboard or customer site data. | ISO 27001 |
| MiniMax ↗ | MiniMax M2.5 + TTS + video (when customer brings MiniMax key) | Global | Prompts + completions; TTS text; video prompts | ISO 27001 |
| Firecrawl ↗ | Web scraping, search, content extraction | Global | URLs requested, scraped content (no PII unless customer requests it) | SOC 2 Type II in progress |
| fal.ai ↗ | Image + video generation (when customer brings fal key) | Global | Image prompts, generated assets | — |
Customer-brought AI provider keys send tokens directly from our infrastructure to the provider. We do not retain prompts or completions beyond the duration of an agent run unless the brain explicitly stores them.