Sub-processor Register
Maintained in our compliance database.
Under UK GDPR Article 28, we disclose every sub-processor that handles personal data on behalf of AllAddin customers. The DPA column links to each provider's own Data Processing Agreement. A machine-readable copy of this register is available at
/api/sub-processors.
Active sub-processors
| Name | Purpose | Data categories | Transfer region | DPA |
|---|---|---|---|---|
| Railway | Application hosting and managed Postgres | application data, request logs, postgres rows | US-DPF | DPA |
| Anthropic | Claude API for code generation and analysis | prompts, completions | US-SCC | DPA |
| GitHub | Source code hosting, issue tracking, CI | source code, CI artefacts | US-DPF | DPA |
| Sentry | Error monitoring with send_default_pii disabled | stack traces, request metadata | EEA | DPA |
| Mistral | Text embeddings for corpus and keynote search | chat query text, corpus text snippets, keynote text | EEA | DPA |
| Cloudflare R2 | Object storage for published share-link payloads | share-link ciphertext (client-side-encrypted dashboard workspaces) | EEA | DPA |
Notifications of changes
When we add or remove a sub-processor, the change is recorded in our internal Trust Ledger (a hash-chained audit log) and this page updates immediately. Customers under an active Data Processing Agreement are notified in advance by email.
Contact
Questions about this register go to security@alladdin.dev.