Sub-processors
Third parties that may process customer personal data on our behalf. We give 30 days' notice of changes to this list.
Last updated 6 October 2026 · Questions: [email protected]
| Sub-processor | Purpose | Location | Applies to |
|---|---|---|---|
| Google Cloud (Google LLC / Google Asia Pacific Pte. Ltd.) | Hosting: Cloud Run, Cloud SQL, Cloud Storage, Pub/Sub, Secret Manager; Vertex AI model inference (Gemini, Claude) — the default inference channel for all organisations | Customer-selected region (default asia-east1 / us-central1); US for Vertex AI unless regional endpoint selected | All |
| GitLab Inc. (GitLab AI Gateway) | Optional managed inference channel (organisation opt-in, and fail-over unless disabled): relays model requests to Anthropic and OpenAI under GitLab's enterprise AI terms. No training on inputs; abuse-monitoring retention only. | United States | Practice, Arena, Studio, Gateway API (standard tier) |
| Anthropic, PBC | Large-language-model inference (counterpart lines, debriefs, Studio drafts, Evaluate/Simulate API, Gateway model calls) — reached via the managed channel above or directly via Vertex AI for GCP-resident tenants | United States | Practice, Arena, Studio, API |
| OpenAI, LLC | Large-language-model inference for GPT-family models (Gateway model calls; fallback for other features) | United States | Gateway API; fallback elsewhere |
| Amazon Web Services, Inc. | Bedrock inference when AWS-resident routing is selected | Customer-selected AWS region | Enterprise/Platform with AWS-resident policy |
| Cloudflare, Inc. | DNS, TLS termination, DDoS protection for public endpoints | Global edge | All |
| Email delivery provider (SMTP relay) | Transactional email: invitations, background debrief delivery | Per provider (disclosed in Order) | Organizations with email delivery enabled |
Model providers are bound by terms prohibiting training on customer content and limiting retention to abuse-monitoring windows (≤30 days) or zero retention where available. The standard routing tier reaches model providers through a managed channel operated by GitLab Inc. under its enterprise AI terms (no training on customer content; limited abuse-monitoring retention). Organisations that require model traffic to stay inside Google Cloud select GCP-resident routing (Vertex AI), or register their own model endpoint (BYO-model) so no third-party inference sub-processor is involved. Ask [email protected] for the current provider statements.
To receive notifications of changes, administrators are subscribed automatically; others may email [email protected].