A sub-processor is a third-party service we use to run sprintrr. Some of these services have technical access to your data in order to provide their service to us — for example, our database provider hosts the customer projects you create, and our AI provider receives the prompts you submit to AI features.
We choose sub-processors carefully (see our Trust page for our vendor-assessment process), and we require them to apply security and privacy controls at least as strong as our own.
Change notification. We notify customers at least 30 days before adding a new sub-processor that processes customer data, where feasible. Emergency additions during a vendor incident may be notified retroactively. To subscribe to changes, email support@sprintrr.ai.
Current sub-processors
| Vendor | Service | Data shared | Location | Certifications | Tier |
|---|---|---|---|---|---|
| Supabase (security page, opens in a new tab) | Database, authentication, file storage | All customer-account data, project content, authentication records, uploaded files | United States (primary region) |
| critical |
| Vercel (security page, opens in a new tab) | Application hosting, edge network | Request metadata, response logs, deployment artifacts (no customer content at rest) | Global edge network |
| critical |
| Anthropic (security page, opens in a new tab) | Claude AI inference for AI-generated content | AI prompts you submit to sprintrr AI features | United States |
| critical |
| OpenAI (security page, opens in a new tab) | GPT inference (only when you Bring Your Own Key) | Prompts you submit — only when you have configured a personal OpenAI key (BYOK) | United States |
| important |
| Google (Gemini API) (security page, opens in a new tab) | Gemini inference for Speed mode, Ask answers and Ask search indexing (embeddings), internal marketing content, and Bring Your Own Key calls | Prompts you submit in Speed mode, Ask questions with the matching project excerpts, and project text indexed for Ask search; with your own Google AI key, the prompts you send on it | United States / global Google Cloud |
| important |
| Google (OAuth) (security page, opens in a new tab) | Sign-in provider when you choose "Continue with Google" | Your Google account email, name, and profile picture | United States / global |
| important |
| Polar.sh (security page, opens in a new tab) | Subscription billing and payments | Customer email, plan, subscription identifiers (no payment-card numbers — those stay with Polar) | United States |
| critical |
| Resend (security page, opens in a new tab) | Transactional email delivery (account emails and customer-published status updates) | Recipient email and message content (transactional only — no marketing) | United States |
| important |
| Slack (Salesforce) (security page, opens in a new tab) | Optional channel for delivering customer-published status updates (OAuth-based, customer-initiated) | Customer-authored status update content; workspace ID and channel ID chosen by the customer | United States |
| important |
| Atlassian (Jira Cloud) (security page, opens in a new tab) | Optional one-way import of issues from a customer-supplied Jira Cloud workspace (customer-initiated, API-token-based) | Customer's Atlassian email + API token (encrypted at rest); read-only access to the chosen Jira project's issue fields | United States / EU / AU |
| important |
| Fireflies.ai (security page, opens in a new tab) | Optional one-way pull of meeting transcripts from a customer-supplied Fireflies account (customer-initiated, API-key-based) | Customer's Fireflies API key (encrypted at rest); read-only access to the customer's meeting titles and transcript text | United States |
| important |
| Cloudflare (security page, opens in a new tab) | Bot protection (Turnstile) and edge security | IP address, browser fingerprint, request metadata | Global edge |
| important |
| Upstash (security page, opens in a new tab) | Rate-limiting state store (Redis) | Anonymous counters keyed by user ID or IP | AWS regions (US/EU) |
| important |
| Sentry (security page, opens in a new tab) | Error monitoring (enabled when Sentry DSN is configured) | Stack traces and request metadata — cookies, authorization headers, and known PII are scrubbed before send | United States / EU options |
| important |
| Axiom (security page, opens in a new tab) | Application log aggregation (enabled when AXIOM credentials are configured) | Application log lines | United States / EU |
| important |
| GitHub (security page, opens in a new tab) | Source code hosting and CI/CD | Application source code, deployment metadata (no customer content) | United States |
| critical |
| Meta Platforms (security page, opens in a new tab) | Advertising conversion measurement (Meta Pixel) on public marketing pages | Page-view and signup-conversion events, IP address, browser/cookie identifiers — marketing visitors only. No project content, task data, or AI prompts. | United States |
| important |
About this list
“Critical” sub-processors are services whose failure or breach would materially affect the sprintrr service or customer-data confidentiality. “Important” sub-processors process some customer data but their failure degrades a non-core feature.
For each Critical and Important sub-processor we maintain an internal vendor-assessment record covering the security certifications listed above, our Data Processing Agreement on file, and the residual risk we accept. Customers under contract may request a redacted assessment.
See our Privacy policy for the rights you have over your personal data, and our Trust page for the overall security program.