Legal
Sub-processors
The third parties that process data on our behalf, what each is used for, and where.
Current list
Who processes data on our behalf
| Sub-processor | Purpose | Location | Data processed |
|---|---|---|---|
| Supabase | Database and authentication | EU (Frankfurt) | Account data, mission metadata, findings |
| Fly.io | Cloud Brain compute infrastructure | Global (region varies) | AI orchestration data |
| Stripe | Payment processing | US (EU data processing) | Billing information |
| Flyworks.ai | AI model provider (agent reasoning) | EU | Mission analysis prompts |
AI model provider
How prompt data is handled
Agent reasoning sends prompts containing target information to our model provider. Processing takes place in the EU.
The specific commitments on training, retention and storage are set out in the data processing agreement, which is available on request. We would rather point you at the executed terms than paraphrase them here.
Changes
How this list is maintained
All sub-processors are bound by data processing agreements, and we evaluate their security practices regularly.
We give at least 30 days’ notice before adding or replacing a sub-processor. You may object within that period, and if we cannot reasonably accommodate the objection you may terminate your account.
If a sub-processor relevant to your assessment is missing here, tell us and we will correct it. An incomplete list is a defect, not a detail.