Trust Centre · Subprocessors
Every entity that touches your data, named.
Nine subprocessors, each with the purpose, the data categories it can see and the region it processes in. We add none without 30 days' written notice and a contractual objection window. A vendor that lists "cloud infrastructure providers" instead of names is not giving you a register.
Register version 11 · Effective 01 Aug 2026 · Last change: model provider added 12 Jun 2026
Current subprocessors
| Entity | Purpose | Data categories | Processing region | Class | Added |
|---|---|---|---|---|---|
| Cloud infrastructure provider — Singapore region | Compute, storage, managed database, object storage | All customer content and metadata, encrypted at rest | Singapore | Material | Mar 2025 |
| Model provider A — Singapore endpoint | Inference through KrewOS-managed keys | Prompt and completion content, zero retention | Singapore | Material | Mar 2025 |
| Model provider B — Singapore endpoint | Inference and fallback routing | Prompt and completion content, zero retention | Singapore | Material | Jun 2026 |
| Managed vector search | Embedding index for Knowledge Packs | Embeddings and document identifiers, no plaintext | Singapore | Significant | May 2025 |
| Log and telemetry platform | Operational and security logging | Metadata, identifiers, no document content | Singapore | Significant | Mar 2025 |
| Transactional email service | Verification codes, notifications, approval alerts | Name, work email, notification subject lines | Singapore | Limited | Mar 2025 |
| Payment processor | Card payment and invoicing | Billing contact, payment token; no card data held by us | Singapore | Limited | Apr 2025 |
| Support ticketing | Customer support correspondence | Name, work email, ticket content you supply | Singapore | Limited | Mar 2025 |
| Status and incident communications | Status page and incident notification, hosted separately from the platform | Subscriber email only | Singapore | Limited | Mar 2025 |
Change history
| Date | Change | Notice given | Objections |
|---|---|---|---|
| 12 Jun 2026 | Model provider B added for fallback routing and provider diversity | 30 days | None received |
| 04 Mar 2026 | Managed vector search moved to a Singapore-resident deployment | 30 days | None received |
| 18 Nov 2025 | Former analytics subprocessor removed; function brought in-house | Not required | — |
| 22 Apr 2025 | Payment processor added ahead of first paid contracts | 30 days | None received |
Subscribe to changes
Advance notice
Thirty days' written notice before any subprocessor is added or its scope materially widened, sent to your registered data-protection contact and to every subscriber on this page.
Objection window
You may object on reasonable data-protection grounds within the notice period. If we cannot resolve the objection, you may terminate the affected service without penalty.
Vendor due diligence
Every subprocessor is risk-tiered and reviewed annually. Material subprocessors are contractually bound to protections no less protective than those in our DPA with you.
"Material" means the subprocessor can access customer content. "Significant" means it can access derived data or metadata but not document content. "Limited" means it touches only account or contact data.