Subprocessors
These are the organisations that receive material from KVAi on our behalf, what each one receives, and where the processing happens. This list is generated from the application's own configuration, so adding a service that processes customer material changes this page in the same commit — which is the only way a list like this stays true.
Where a transfer leaves the UK or the EEA it is named as such below. A customer's own client may ask about these specifically, particularly the first one.
| Who | What for | What they receive | Where |
|---|---|---|---|
| Anthropic | Generating drafts |
The brief as written, the passages retrieved from the client space and shared library, and the draft that comes back.
The most sensitive transfer in the product: briefs and drafts concern unapproved promotional material. No customer content is used for training under Anthropic's commercial terms — confirm the contract in force says so.
|
United States |
| Knowledge service | Indexing and retrieval of client documents |
Uploaded client documents in full, and the queries run against them.
A separate service with its own brief. It exposes ingest and retrieve only, and no delete — so a document withdrawn in KVAi is filtered out of retrieval but still held there. That has to be stated honestly to customers, and fixed at the interface.
|
To be confirmed |
| Stripe | Payments |
Billing name and address, card details entered directly into Stripe's own fields, and the amounts charged. Card numbers never reach KVAi.
Also the source of the VAT invoice for each payment.
|
United States, with EU processing |
| Amazon Web Services (SES) | Sending email | Recipient addresses and the content of the emails listed in the privacy notice — invitations, verification codes, run and approval notifications. | United Kingdom (AWS eu-west-2, London) |
| Amazon Web Services (hosting) | Hosting the application and its database | Everything the product stores. | To be confirmed — see the data region item on the launch checklist |
| Sentry | Error reporting |
Diagnostics only. Confidential fields are stripped before anything is sent, and events carry tenant, client space and user identifiers but no names. Session Replay and AI tracing are switched off deliberately.
The ingest endpoint in use is a US one.
|
United States |
| Google Fonts | Serving two typefaces |
A visitor's IP address, by virtue of the browser fetching the font files.
Avoidable. Self-hosting these two fonts removes a third-country transfer entirely and is a small change — recommended before launch.
|
United States |
Notification of changes
We will tell workspace owners before a new subprocessor starts processing customer material, so that there is time to object. The mechanism for that notice is not yet built.