--- title: "Sub-processors" description: "The sub-processors Clueso engages, grouped by when they are used — platform, AI processing, and code-connected content generation — with the controls that apply to each." url: "https://www.clueso.io/legal/subprocessors" updated: "2026-08-24T17:20:02.569Z" --- # Sub-processors The sub-processors Clueso engages, grouped by when they are used — platform, AI processing, and code-connected content generation — with the controls that apply to each. **About this list** This is the list of sub-processors referenced by Clueso's Data Processing Agreement and Privacy Policy. **Changes are posted here at least ten (10) business days before they take effect**, and customers under a Data Processing Agreement may object within ten (10) business days of an update, on the terms set out in that agreement. Subscribe below to be notified when this list changes. ### 1. How this list is scoped Sub-processors are scoped to the modules a customer has enabled. A customer using hosting only receives a materially shorter list than one using recording and generation. The platform group applies to everyone. ### 2. Platform Engaged for every customer, including hosting-only. **Sub-processor**: Amazon Web Services, Inc. **Purpose**: Cloud infrastructure and storage **Location**: United States **Sub-processor**: PropelAuth, Inc. **Purpose**: Authentication and identity **Location**: United States **Sub-processor**: Sentry (Functional Software, Inc.) **Purpose**: Error monitoring and crash reporting **Location**: United States **Sub-processor**: PostHog, Inc. **Purpose**: Product analytics **Location**: United States **Sub-processor**: HubSpot, Inc. **Purpose**: Customer relationship management **Location**: United States **Sub-processor**: Stripe, Inc. **Purpose**: Payment processing **Location**: United States **Sub-processor**: Google LLC **Purpose**: Website analytics (marketing site only) **Location**: United States ### 3. Recording, transcription and generation Engaged where the customer records or generates content. Not engaged for hosting-only customers. Multiple providers are retained per capability for redundancy and quality; where a customer restricts Clueso to an approved subset, calls to the remaining providers are excluded for that workspace. **Capability**: Speech-to-text **Sub-processor**: Deepgram · AssemblyAI · OpenAI · Google **Data received**: Recording audio **Capability**: Large language models **Sub-processor**: Anthropic · OpenAI · Google (Gemini) **Data received**: Transcript, screenshots, document content **Capability**: Text-to-speech **Sub-processor**: ElevenLabs · Cartesia · OpenAI · Google **Data received**: Voiceover script **Capability**: Image generation **Sub-processor**: Google · OpenAI **Data received**: Image prompts **Capability**: Object storage **Sub-processor**: Google Cloud Storage **Data received**: Generated media assets **Capability**: LLM observability **Sub-processor**: PostHog, Inc. **Data received**: Model inputs and outputs on instrumented paths ### 4. Code-Connected Content Generation Engaged only where Code-Connected Content Generation is enabled. See the corresponding annex in the customer's Data Processing Agreement for full detail. **Sub-processor**: Anthropic, PBC **Purpose**: Analysis of connected source code **Location**: United States **Sub-processor**: GitHub, Inc. · GitLab Inc. · Atlassian **Purpose**: Customer-authorised repository access, read-only **Location**: United States ### 5. Customer-authorised destinations Where a customer connects a documentation platform, Clueso writes generated content into the customer's own tenant on that platform at the customer's direction. **Platform**: Intercom **Purpose**: Publishing generated help content to the customer's Intercom workspace **Platform**: Mintlify **Purpose**: Publishing generated documentation to the customer's Mintlify site **Platform**: Sanity **Purpose**: Publishing generated content to the customer's Sanity dataset ### 6. Controls applying to all sub-processors • **Diligence before engagement.** Security posture, certifications such as SOC 2 and ISO/IEC 27001, data-residency arrangements and contractual data-protection commitments are assessed before a sub-processor is engaged. • **Written data processing agreements** covering confidentiality, security, purpose limitation, breach notification and data-subject rights. • **Standard Contractual Clauses** where the sub-processor processes personal data of individuals in the EEA, UK or Switzerland, together with the UK International Data Transfer Addendum where applicable. Copies are available to customers on request. • **No training on customer data.** AI sub-processors confirm in writing that Clueso customer content will not be used to train any generalised model, will be retained only as long as necessary to deliver the requested processing, and will be deleted consistent with Clueso's retention schedule. • **Server-side calls only.** All sub-processor calls are made by the application backend. Provider credentials never leave the backend. • **Annual review** of all AI vendors for continued compliance with security standards and regulatory requirements. ### 7. Data residency Customer content and the stores holding it are localised to the region the customer selects: Mumbai (ap-south-1), Frankfurt (eu-central-1) or California (us-west-1). Account identity data — name, work email and organisation, containing no customer content — is held in a single global store. The AI sub-processors above are United States services, so at the AI processing step content is transferred outside its storage region. These transfers are covered by data processing agreements incorporating Standard Contractual Clauses where applicable. ### 8. Retention Sub-processors do not retain or reuse customer content beyond the defined processing request. Within Clueso, content marked for deletion by the customer is securely deleted or anonymised within a maximum of thirty (30) days. **Information Security Officer**privacy@clueso.ioDesklamp, Inc. d/b/a Clueso