Legal
Subprocessors
The providers Prometheor uses, their purpose, data boundary, region or transfer note and current activation status.
Configured provider register
| Provider | Purpose | Data boundary | Region or status |
|---|---|---|---|
| Vercel, Inc. | Web, BFF, MCP, WAF, runtime logs and signed Log Drain | Requests, encrypted payload in transit and minimized logs | fra1. Prometheor's application functions run in Vercel's Frankfurt region (fra1). Vercel, Inc. is a United States company; request routing, edge protection and runtime logs may involve processing in the United States under Vercel's Data Processing Addendum with the EU standard contractual clauses as the transfer safeguard. Runtime logs contain no Memory content. Log Drain: inactive. |
| Supabase, Inc. | Authentication and PostgreSQL | Identity/session metadata, encrypted canonical Memory and receipts | Database project in Frankfurt; provider subprocessors operate under the reviewed DPA |
| Google Cloud | KMS and encrypted recovery storage | Ciphertext, wrapped keys and object metadata | Frankfurt recovery resources under the reviewed Cloud Data Processing Addendum |
| Google identity services | Owner and user sign-in | Identity and OAuth metadata | OAuth terms and user-data policies reviewed for the selected launch markets |
| Stripe Payments Europe, Ltd. | Payments, subscriptions, invoices and the customer portal | Billing name, email, address, payment details, plan and invoice records | Ireland (EU); transfers to Stripe, Inc. (USA) under the EU-US Data Privacy Framework and Standard Contractual Clauses |
| Resend | Alert email and the confirmation of cancellation or withdrawal | Destination address, delivery metadata, and the declaration you submitted | Resend, Inc. sends Prometheor's content-free operational alert and account-notification emails from its Ireland (eu-west-1) sending region; Resend stores account metadata, delivery logs and API records in the United States under Resend's Data Processing Addendum with the EU standard contractual clauses. These emails never contain Memory content. |
| OpenRouter, Inc. | Routing for the separate message-capture test | Eligible user-written text and request/accounting metadata | Internal owner test only; not enabled for users. Route is global; EU-only inference is not established |
| TypeSafe AI, Inc., through OpenRouter | Relevance check in the separate message-capture test | Bounded eligible input for the relevance decision | Internal owner test only; not enabled for users. Zero-data-retention and no-training routing required |
| OpenAI, through OpenRouter | Suggestion extraction in the separate message-capture test | Bounded eligible text | Internal owner test only; not enabled for users. Zero-data-retention and no-training routing required |
Provider records
- Vercel Data Processing Addendum (external)
- Supabase Data Processing Addendum (external)
- Google Cloud Data Processing Addendum (external)
- Google OAuth 2.0 Policies (external)
- Google API Services User Data Policy (external)
- Resend Data Processing Addendum (external)
- Stripe Data Processing Agreement (external)
- Resend region and data-residency documentation (external)
Prometheor updates this register before a newly configured provider receives your data.