Subprocessor List
This page identifies categories of third-party service providers that DevAI may authorize to process Customer Data in connection with providing DevAI Suite.
DevAI requires subprocessors to handle data in accordance with contractual protections appropriate to the services they provide.
EU guidance places weight on transparency around processors and subprocessors, so keeping this page current is important even at an early stage.
1. How We Use Subprocessors
We may use subprocessors to support:
- cloud hosting and infrastructure;
- data storage and backup;
- authentication and identity services;
- payment processing;
- customer support and communications;
- monitoring and logging;
- analytics;
- document or email delivery;
- AI inference or model infrastructure, if applicable;
- other operational services reasonably necessary to provide the Service.
2. Current Subprocessor Table
The following subprocessors are currently authorized to process Customer Data in connection with DevAI Suite. Processing regions reflect current vendor configuration and may change as described in Section 3.
| Vendor | Service Category | Purpose | Data Potentially Involved | Primary Processing Region |
|---|---|---|---|---|
| Fly.io | Hosting / Compute | Runs the API, web application, and background workers | Customer Data in transit, application logs, account data | EU (Frankfurt) |
| Neon | Managed Database | PostgreSQL + pgvector; tenant data at rest with Row-Level Security isolation and RAG vector storage | All Customer Data at rest | EU (Frankfurt, aws-eu-central-1) |
| Cloudflare | CDN / Object Storage / Bot Protection | DNS and edge delivery, R2 document & template storage, Turnstile CAPTCHA | Uploaded documents & templates, request metadata, challenge tokens | EU / global edge (Cloudflare network) |
| Together AI | AI / Model Inference | Default LLM inference | Prompts and retrieved snippets, model outputs | United States (vendor-hosted API) |
| Voyage AI | AI / Embeddings | Generates vector embeddings of tenant documents for retrieval (RAG) | Document text chunks | United States (vendor-hosted API) |
| Anthropic | AI / Model Inference | Claude model inference on elevated / opted-in lanes | Prompts, model outputs | United States (vendor-hosted API) |
| OpenAI | AI / Model Inference | GPT model inference as a configurable fallback | Prompts, model outputs | United States (vendor-hosted API) |
| Inngest | Background Jobs | Orchestrates document-indexing and asynchronous jobs | Job event metadata (document references) | United States (vendor-hosted API) |
| Resend | Transactional Email | Account verification and notification email delivery | Email addresses, notification content | United States (vendor-hosted API) |
| Stripe | Payments | Subscription billing and payment processing | Billing / account metadata; card data is tokenized by Stripe and never stored by DevAI | United States / global |
| Sentry | Monitoring / Error Tracking | Application error and performance monitoring | Stack traces and request context, PII-scrubbed before transmission | United States |
| RunPod (conditional) | AI / GPU Compute | GPU inference for self-hosted DevAI models — active only when an organization enables self-hosted models (off by default) | Prompts, model outputs (only when enabled) | United States / EU (region-selectable) |
Compute and the primary database are hosted in the EU (Frankfurt). Several AI inference, embedding, email, and monitoring vendors process data via US-hosted APIs; such transfers are governed by the applicable Data Processing Agreement and Standard Contractual Clauses. AI inference vendors receive prompt content only when a user invokes an AI feature, subject to your organization's AI settings.
3. Updates to This List
We may update this list from time to time as our Service evolves. Material changes may be reflected by updating this page, and where contractually required we may provide notice through the Service or by email.
4. Questions
Questions regarding subprocessors may be sent to: admin@devaisuite.com