Sub-processors

A sub-processor is a third party that processes data on our behalf. This page names all of them. It is not a summary of a longer list held somewhere else, and there is no second tier of vendors we consider too minor to mention.

The list is maintained in the same change that adds the vendor. Our continuous integration blocks a merge that introduces a third party without updating this page in the same commit, so the page cannot quietly fall behind the system it describes.

Adding or replacing a sub-processor that processes customer personal data carries 30 days' notice and a right to object, set out in the Data Processing Agreement.

These are the only third parties that receive prompt and completion content. Neither trains on it. Prompt and completion bodies are not persisted by ModelBeat.

Fireworks AI, Inc.

Model inference for the entire eligible production catalogue. Receives request content for the requests routed to it, and is contractually barred from training on it. United States, and its own onward sub-processors also process in Japan, Iceland, the United Kingdom and Germany. Active: a data processing agreement is in force and is incorporated by reference into the terms we have accepted.

Amazon Web Services, Inc. (Amazon Bedrock)

Model inference, inside ModelBeat's own AWS account. Would receive request content while enabled, and does not train on it. United States, us-west-2. Dormant: it receives no traffic today. Re-enabling it is a manual and deliberate action. It is never an automatic failover.

These run the service around the gateway: infrastructure, billing, sign in and measurement. None of them receives prompt or completion content, with the single exception noted against the web tools.

Amazon Web Services, Inc.

Compute, database, object storage, key management, secrets management and console sign in. Holds all service data, encrypted at rest. United States, us-west-2.

Stripe, Inc.

Payments and prepaid credit. Receives billing email and payment metadata. Card data never reaches ModelBeat: checkout is hosted by Stripe. United States, with the European Union as failover.

Sendinblue SAS, trading as Brevo

Transactional authentication email: verification, password reset and account notices. Receives the recipient's email address and the code contained in the message. European Union, France.

Firecrawl, Inc. (Mendable AI, Inc.)

Web search and page fetch for the web tools. Receives the search query and the fetched page content, and only for workspaces that have explicitly enabled web tools. United States.

Google LLC (Google Analytics 4)

Aggregate website and console usage measurement. Receives pageview and feature usage events. On this website it loads only if you allow the analytics category, which is described in the Cookie Policy. United States.

Our support desk runs on a self-hosted Chatwoot instance inside our own AWS account. No third party receives your support messages. We list it because a data subject request needs to be able to reach it.

That is the general rule rather than an exception. Self-hosted software is not a sub-processor: open source components we run ourselves on our own cloud account introduce no third party, and the cloud provider is the sub-processor for that infrastructure and is already listed above.

We give at least 30 days' notice before a new or replacement sub-processor begins processing customer personal data, by email or in the console. If you object on reasonable data protection grounds within that period, the process and your remedy are set out in the Data Processing Agreement.

To be added to the notice list, or to ask anything about an entry on this page, write to hello@neuralarc.ai.