Sub-processor List
This page lists the third parties (“Sub-processors”) that this+that engages to provide the Service and that may process Customer Data on this+that’s behalf. We publish this list to satisfy the notice and objection rights in our Data Processing Addendum.
How sub-processors are selected
We use sub-processors only where they are necessary to provide the Service and where they meet our security and data-protection criteria. Every sub-processor that processes Customer Data is bound by a written agreement that imposes data protection obligations at least as protective as our DPA. None of our sub-processors are authorized to use Customer Data to train, fine-tune, or otherwise improve any machine learning or generative AI model.
How to be notified of changes
To receive email notification of changes to this list, email legal@thisandthat.chat with the subject “Sub-processor notifications” and the address you would like notifications sent to. We will add that address to our notification list. We give at least ten (10) days’ notice before authorizing a new sub-processor that processes Customer Data, and customers may object as described in Section 6 of the DPA.
Current sub-processors
Infrastructure
| Sub-processor | Service provided | Data processed | Location of processing |
|---|---|---|---|
| Amazon Web Services, Inc. | Cloud hosting, compute, storage, databases, key management (KMS), email delivery, logging | All Customer Data, including the contents of mailboxes, messages, calendars, files, tasks, and brain pages | United States |
| Amazon Web Services, Inc. (Bedrock) | Managed AI inference service used to call foundation models | The portion of Customer Data sent to an AI model to fulfill a feature (for example, a message being summarized, drafted, or classified) | United States |
| Anthropic, PBC | Foundation model inference, accessed exclusively through Amazon Bedrock under Bedrock terms that prohibit training on customer inputs and outputs | The portion of Customer Data passed to the Anthropic model for the duration of the request | United States |
| TypeSafe AI, Inc. | Structured classification model (Jev), called directly over its API under documented processing instructions that prohibit training or fine-tuning on customer inputs | The portion of Customer Data passed to the model for classification for the duration of the request | United States |
Platform services
| Sub-processor | Service provided | Data processed | Location of processing |
|---|---|---|---|
| Clerk, Inc. | User authentication, session management, multi-factor authentication | Authentication identifiers (email, name, hashed credentials), session tokens, IP addresses | United States |
| Stripe, Inc. | Billing, subscription management, payment processing | Customer name, billing email and address, payment method details, transaction history. Stripe is an independent controller for payment data. | United States |
| Functional Software, Inc. (Sentry) | Application error and performance monitoring | Application stack traces and contextual metadata; user identifiers (email or user ID) attached to errors. Sentry is configured to scrub Customer Data from error events. | United States |
| Intercom, Inc. | In-app customer support messaging, support ticket history | Authorized User identifiers (name, email, account ID) and any content Authorized Users share in support conversations | United States |
| HubSpot, Inc. | Customer relationship management for account, billing, and lifecycle communications | Account-level contact information (name, business email, company name, plan, account lifecycle events). HubSpot is not used to process the contents of mailboxes, messages, or other Customer Data. | United States |
| Apple Inc. | Signing and distribution of Delegate, the optional macOS application, and crash reporting from it through App Store Connect | The application binary; crash reports carrying stack traces and diagnostic state from the user’s own device, which can include fragments of what Delegate was processing | United States |
| Google LLC | OAuth provider for customer Gmail, Calendar, Chat and Drive connections | Authentication identifiers and the message, calendar and file content the user authorises | US / EU |
| Microsoft Corporation | OAuth provider for customer Outlook and Teams connections | Authentication identifiers and the message content the user authorises | US / EU |
| Slack Technologies, LLC | OAuth provider for customer Slack workspace connections | Workspace, channel and message content the user authorises | US |
| Meta Platforms, Inc. | OAuth provider for WhatsApp Business and Messenger connections | Message content and metadata from the connected account | US / vendor-managed |
Third-party integrations you enable
this+that supports integrations with third-party tools that an Authorized User may choose to connect, including over the Model Context Protocol (MCP). These are not Sub-processors. We do not engage these providers, we hold no agreement with them, and no data reaches them unless a user connects the integration and directs a request to it.
Because we have no contractual relationship with these providers, you are responsible for reviewing a provider’s terms and privacy practices before enabling its integration, and for putting in place any agreement you require with them directly. Enabling an integration is an instruction from you to transmit the relevant data.
Adding support for a new integration does not trigger the notice in Section 6.3 of the DPA, because whether any data reaches a provider is your decision rather than ours. The Integrations page in the app lists the providers we ship a shortcut for, and you can also connect any MCP server by entering its URL. So the providers in this category are whichever ones you choose to connect, and the examples below are not a limit on them.
| Category | Examples | Data processed |
|---|---|---|
| Task and project tools | Asana, Atlassian (Jira), ClickUp, Linear, Monday, Motion, Notion, Salesforce, Shortcut, Trello | Task content, titles, assignees and related metadata the user syncs |
| File and design tools | Box, Canva, Dropbox, Figma | The files and metadata a user’s request reaches |
| Research and meeting tools | Glean, Granola, Tavily | The content of the user’s request, and results returned |
| Developer tools | GitHub, Sourcegraph | Repository and issue content a user’s request reaches |
| Marketing data | Meta Ads, Windsor.ai | The content of the user’s request |
| Data platforms | Snowflake | The content of the user’s request, and rows returned |
| CRM | HubSpot | The records a user’s request reaches |
Other AI providers
We may, from time to time, route portions of model inference traffic through additional foundation model providers (for example, providers accessible through Amazon Bedrock or comparable services) to improve quality, latency, or cost. Any such provider will appear on this list before processing Customer Data, will be bound by no-training restrictions, and will be subject to the notice and objection rights described above.
Sub-processors of sub-processors
Our sub-processors may engage their own sub-processors (for example, AWS uses sub-processors for some of its services). We require each sub-processor to apply flow-down terms that are no less protective than the DPA.
Contact
Questions about this list, or about how a specific sub-processor handles Customer Data? Email legal@thisandthat.chat.
Changelog
-
September 22, 2026. Added TypeSafe AI, Inc. as a Sub-processor. TypeSafe provides Jev, a structured classification model we call directly over its API to classify the content of messages. Its processing is bound by documented instructions under its Data Processing Addendum that prohibit training or fine-tuning any model on our inputs and limit retention to what serving a request requires. TypeSafe processes in the United States and engages Amazon Web Services and Modal as its own sub-processors. This entry is the notice required by Section 6.3 of the DPA; no Customer Data will be sent to TypeSafe until at least ten days after this date, and customers may object as described there.
-
September 15, 2026. Documentation catch-up in the “Third-party integrations you enable” table: added Glean, Sourcegraph, Meta Ads, Snowflake, and HubSpot to the connector categories. These integrations have been available for some time and are connected only by a customer’s own choice, so nothing changed about how Customer Data is processed and Section 6.3 notice does not apply, per that section’s own terms.
-
September 11, 2026. Added Apple Inc. as a Sub-processor. Apple signs and distributes Delegate, the optional macOS application, and receives crash reports from it through App Store Connect. A crash report carries stack traces and diagnostic state from the user’s own device and can include fragments of what Delegate was processing. This entry is the notice required by Section 6.3 of the DPA; Apple will not begin receiving crash reports until at least ten days after this date, and customers may object as described there.
-
August 12, 2026. Added Google, Microsoft, Slack and Meta as Sub-processors in their capacity as OAuth providers for the communication channels customers connect. Added a “Third-party integrations you enable” section covering tools a user may connect themselves, including over MCP; these are not Sub-processors and adding one does not trigger the Section 6.3 notice. Reduced the notice period for new Sub-processors from thirty to ten days. Website analytics providers (Google Analytics, Microsoft Clarity, Inspectlet, GrowthBook, CookieYes, Meta advertising) process website visitor data rather than Customer Data and are disclosed in the Privacy Policy instead.
-
June 9, 2026. Initial publication. Includes AWS, AWS Bedrock, Anthropic, Clerk, Stripe, Sentry, Intercom, and HubSpot. Establishes the email-based notification process for future changes.