The third-party service providers Autonowmy engages to deliver the Platform. Each is bound by written terms imposing equivalent confidentiality and security obligations to those in our Data Processing Agreement.
Cloud providers that host the Platform's compute, storage, and networking. Tenant data is encrypted at rest and isolated per tenant. Customer-selected deployment region determines primary data residency.
| Sub-processor | Service | Region | Data accessed |
|---|---|---|---|
| Amazon Web Services | Compute, storage, networking, key management. Primary hosting for AP-South, EU-West, and US-East deployments. | AP-South · EU-West · US-East | All customer data (encrypted)All Personal Data routed through the Platform, encrypted at rest with customer-isolated keys. |
| MongoDB Atlas | Managed MongoDB for canvas metadata, module registry, and persistence layer of the Slate host app. | AP-South · EU-West · US-East | Canvas metadata onlyCanvas designs, dashboards, agent configurations. No raw telemetry. |
| Cloudflare, Inc. | CDN, DDoS protection, edge TLS termination for the public website (autonowmy.com) and customer endpoints. | Global edge | Encrypted in transitHTTP request/response metadata only; no decrypted Personal Data. |
LLM providers and inference services that power agent reasoning. Choice and routing is tenant-configurable; customers may restrict to on-prem / private deployments under Single-Tenant or Air-Gapped contracts.
| Sub-processor | Service | Region | Data accessed |
|---|---|---|---|
| Anthropic, PBC | Claude family LLM inference via Anthropic API. Used for agent reasoning, tool use, and natural-language generation when selected by the customer. | US, EU (model dependent) | Inference prompts onlyPrompt content for the duration of inference. Anthropic does not train on API data. |
| OpenAI, L.L.C. | GPT family LLM inference via OpenAI API. Used as configured by the customer; can be disabled per tenant. | US, EU | Inference prompts onlyPrompt content for the duration of inference. OpenAI API zero-retention is enabled. |
| Google Cloud Vertex AI | Gemini family LLM inference; embeddings; vector search. | AP-South · EU-West · US-East | Inference prompts & embeddingsCustomer-configured. Tenant-isolated. |
Internal telemetry from our infrastructure and the Platform's own operations. No Customer Personal Data is sent to these tools.
| Sub-processor | Service | Region | Data accessed |
|---|---|---|---|
| Langfuse GmbH | LLM trace observability. Powers the Observability module — every agent reasoning step, tool call, and response is logged and replayable. | EU-West (self-hosted option) | LLM traces (configurable)Trace metadata, prompts, completions. Customers may self-host Langfuse for full data residency. |
| Sentry, Inc. | Error and exception monitoring for application and runtime errors. | US, EU | Error metadata onlyStack traces, request IDs. PII is scrubbed before transmission. |
| Grafana Labs | Infrastructure metrics, logs, and traces (Grafana Cloud) for internal SRE. | EU, US | Infrastructure metricsSystem metrics, no Customer Personal Data. |
Email delivery, scheduling, and customer-support tooling used by our team.
| Sub-processor | Service | Region | Data accessed |
|---|---|---|---|
| Google LLC (Workspace) | Corporate email, calendar, drive. Our team uses Workspace for internal communication and external email with customers. | Global (Google data residency commitments) | Email correspondenceWhatever you email to allison@autonowmy.com or our team. |
| Postmark (ActiveCampaign) | Transactional email — DPA countersignature delivery, account notifications, breach-notification email. | US, EU | Email metadataRecipient address, sender, subject, message body. |
| Cal.com, Inc. | Scheduling tool for walkthroughs and intro calls booked from the website. | EU-West | Booking detailsName, email, selected time slot, notes you add. |
When you enable a connector (e.g., to your Datadog, ServiceNow, or Salesforce tenant), data flows between your systems and the Platform under your authentication. Those vendors are your sub-processors of your data — they are listed here for reference.
| Sub-processor | Service | Region | Data accessed |
|---|---|---|---|
| Customer-configured | Connector targets — Datadog, Splunk, ServiceNow, Salesforce, SAP, Snowflake, etc. — are activated only at your direction. | Customer-determined | Per your configurationEach connector reads/writes only what you authorize. |
How and when we let customers know about sub-processor changes — and how to opt in for the notice list.
Material additions, replacements, or changes to a sub-processor that affect Personal Data processing are notified at least 30 days before they take effect.
Email to your DPA notification contact and an update to this list. The "Last updated" date in the header reflects the most recent change.
You may object in writing on reasonable data-protection grounds within 14 days of notice. We work in good faith to resolve; if unresolved, you may terminate the affected service portion.
Enterprise customers under a signed DPA are automatically on the notice list. Anyone else evaluating Autonowmy can opt in to receive the same notices.
Email allison@autonowmy.com to subscribe →