We keep this list short deliberately. Each subprocessor is bound by data-protection terms, engaged only for the purpose listed, and reviewed before addition. Material changes to this list are announced in-product.
| Provider | Purpose | Region | Data involved |
|---|---|---|---|
| Supabase | Database, authentication, file storage | Cloud (managed Postgres) | Core platform data |
| Vercel | Application hosting, CDN, edge network | Global edge | Application delivery |
| Stripe | Payment processing, billing, payouts | Global | Payment data (PCI-DSS L1 — we never store cards) |
| Resend | Transactional email delivery | Cloud | Email address, message content |
| OpenAI (default) / customer-configured LLM | AI feature processing | Cloud | Workspace content sent for requested AI operations only |
| Cloudmersive | Antivirus scanning of uploads | Cloud | File contents at scan time |
Bring-your-own AI
If you configure your own model endpoint (BYO-LLM), that provider processes AI requests under YOUR agreement with them and is not our subprocessor.
Questions
privacy@workbos.com