Subprocessors
Draft for legal review. Version 2026-10-22. Regions, transfer mechanisms and DPAs marked [confirm] must be checked against each provider's current contract before launch.
| Provider | Purpose | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| Supabase | Database, authentication, file storage (logos) | All customer and visitor data stored by Agentik | EU (Frankfurt, AWS eu-central-1) | Within the EU; provider DPA [confirm] |
| Cloudflare | Application hosting (Workers), job queues, scheduled tasks, bot protection (Turnstile) | Requests in transit, job ids (no content in queues) | Global edge network | [DPF / SCCs, confirm] |
| OpenAI | AI answers, embeddings for search, business profile and translations | Questions, relevant knowledge excerpts, short conversation history | United States [EU data residency option, confirm] | [DPF / SCCs, confirm]; API data not used for training; retention [confirm, zero data retention available on request] |
| Firecrawl | Rendering public web pages that need JavaScript (only when our own reader finds nothing) | Public page addresses and content | [United States, confirm] | [SCCs, confirm] |
| Monri | Card payments (when billing launches) | Billing contact, payment data (card data handled by Monri) | [Bosnia and Herzegovina / Croatia, confirm] | [confirm] |
| [Email provider, to be chosen] | Account and notification emails | Name, email address, message | [confirm] | [confirm] |
Not subprocessors: GitHub hosts our source code only and never receives customer data.
We announce changes to this list at least [30] days in advance.