A subprocessor is a third party we engage that may process customer personal data in the course of delivering the Service. Each is bound by a written agreement imposing confidentiality and security obligations no less protective than those in our Data Processing Addendum.
Integrations are not subprocessors. Services you connect — Slack, Gmail, HubSpot, Salesforce and the rest of our integration catalogue — are third parties you choose, authorise and control. Data flows to them at your instruction, under your agreement with them. They are listed in the integrations directory, not here.
Infrastructure
Hosting, storage and networking for the platform itself.
| Subprocessor | Purpose | Location |
|---|---|---|
| Microsoft Azure | Application hosting, PostgreSQL, Blob storage, Redis cache and queueing | United States (East US) |
| Amazon Web Services (S3) | Object storage for knowledge-base source documents | United States |
| Qdrant Cloud | Vector storage for knowledge-base embeddings | United States |
| Pinecone Engaged only when configured | Vector storage, where selected as the knowledge-base backend | United States |
Model providers
Engaged only for the provider an agent is configured to use. With your own API key, requests run under your agreement with that provider, not ours.
| Subprocessor | Purpose | Location |
|---|---|---|
| OpenAI | Model inference | United States |
| Anthropic | Model inference | United States |
| Google (Gemini) | Model inference | United States |
| Microsoft Azure OpenAI | Model inference | United States (East US) |
| Mistral AI Engaged only when configured | Model inference | European Union (France) |
| xAI Engaged only when configured | Model inference | United States |
| DeepSeek Engaged only when configured | Model inference | People's Republic of China |
| OpenRouter Engaged only when configured | Model routing to third-party providers | United States |
Agent capabilities
Services invoked when an agent uses the corresponding capability.
| Subprocessor | Purpose | Location |
|---|---|---|
| Orthogonal Engaged only when configured | Unified API gateway for third-party tool calls | United States |
| MonID Engaged only when configured | Third-party tool execution provider | United States |
| Unstructured | Document parsing for knowledge-base ingestion | United States |
| Firecrawl Engaged only when configured | Web page retrieval for agent browsing | United States |
| Serper Engaged only when configured | Web search results for agent research | United States |
| Bright Data Engaged only when configured | Web data retrieval | Israel |
| LiveKit Engaged only when configured | Real-time audio transport for voice sessions | United States |
| AssemblyAI Engaged only when configured | Speech-to-text for voice sessions | United States |
| Cartesia Engaged only when configured | Text-to-speech for voice sessions | United States |
Business operations
Email, payments, monitoring and analytics.
| Subprocessor | Purpose | Location |
|---|---|---|
| Postmark (ActiveCampaign) | Transactional and notification email | United States |
| Razorpay | Payment processing and subscription billing | India |
| Google Firebase (FCM) | Mobile push notification delivery | United States |
| Twilio Engaged only when configured | SMS and voice delivery | United States |
| Sentry | Application error monitoring | United States |
| New Relic | Application performance monitoring | United States |
| Google Analytics | Website analytics (marketing site only, after consent) | United States |
Model providers, specifically
A model provider is engaged only for the agents you configure to use it. If every agent in your workspace uses one provider, that is the only provider that ever receives your content. Nothing is silently routed elsewhere, and nothing is added to this list without the notice described below.
Where you bring your own API key, requests run under your agreement with that provider. In that arrangement the provider is your subprocessor, not ours.
Every provider we engage is contractually restricted from using your content to train or improve models. See the AI Addendum.
Cross-border transfer
Most of these subprocessors are located outside India, and the platform itself is hosted on Microsoft Azure, East US (Northern Virginia, United States). Transfers of EEA and UK personal data rely on the European Commission’s Standard Contractual Clauses with the UK Addendum where applicable. Where a subprocessor is located in a jurisdiction that matters to your risk assessment, the location column above states it plainly rather than aggregating it into a region.
Changes to this list
We will give 30 days’ notice before a new subprocessor begins processing customer personal data. Customers with a signed DPA can subscribe to that notice by writing to legal@turtleaicoworker.com with the subject “Subprocessor notifications”.
If you have a reasonable, documented data-protection objection to a new subprocessor, tell us within those 30 days and we will work with you to find an alternative. Where no reasonable alternative exists, you may terminate the affected part of the Service and receive a pro-rated refund of prepaid fees for the unused term — an exception to the usual no-refund rule in the Cancellation & Refunds Policy.
Onward subprocessors
Some subprocessors use their own infrastructure providers. We remain fully responsible to you for their acts and omissions, as if they were our own.
Questions about this document? Write to legal@turtleaicoworker.com.