// TRUST
Subprocessors
A subprocessor is a provider that processes customer data on behalf of ArtifactBridge. This page lists every current subprocessor, states what each one processes and where, and states how we notify you of a change. Section 4 of the Privacy Policy describes the same providers.
1. Current Subprocessors
| Provider | Purpose | Data category | Processing location | Effective date |
|---|---|---|---|---|
| Supabase | Authentication and Postgres database hosting. | Account data, workspace data, managed document content and versions, comments, audit records, transactional sign-in email. | European Union region. | August 7, 2026 |
| Cloudflare | Application and static-site hosting: Workers (API, MCP server, OAuth), Pages and asset storage (web application), Workers KV (OAuth records and request nonces), Durable Objects (chat companion sessions), Workers AI (chat companion model), Workers Logs (request logs). | Request data, account and workspace identifiers, OAuth records, document content sent to the chat companion, request logs. | Global edge network. | August 7, 2026 |
| Pipedream | Connection broker for the external accounts you authorize (Google Drive, Notion, Slack). Holds the provider credentials and performs the source calls. | Connected-account credentials and identifiers, document content and comments in transit during a sync. | United States. | August 7, 2026 |
| OpenAI | Text embeddings for semantic search, when the semantic features of the deployment are enabled. The Service sends the text to be indexed or the text of the query, and stores only the returned vector. | Document title and body text, Agent Room title, tags and description, and semantic-search query text. | United States. | August 7, 2026, for a deployment with the semantic features enabled. |
| Exa | Web search for the chat companion, when companion web search is enabled. The Service sends the search query text of the companion turn and receives public web results. | Search query text. | United States. | August 7, 2026, for a deployment with companion web search enabled. |
| PostHog | Product analytics for the landing funnel and for signed-in product use, including the product tour. | Landing: cookieless event names and allowlisted campaign properties, visitor IP for coarse region. Signed-in: user id, feature and tour step names, the AI tool used, timing, and short details of the action, for example the plan chosen or the source connected. No email. No document content. During the beta: masked session recordings of the signed-in Service, tied to your user id, unless the member turns recording off. | European Union (Frankfurt). | Landing events: listed since August 19, 2026; capture started with the next production Worker release after that date. Signed-in product events: from the production release that follows this notice. Session recordings: product tour pages from September 15, 2026; the whole signed-in Service from the production release that follows this notice, during the beta. |
| Stripe | Payment processing. Pending. | Billing contact data and payment details. | United States. | Pending — added when it starts to process production data. |
| Postmark | Transactional email delivery. Pending. | Email address, message content, delivery events. | United States. | Pending — added when it starts to process production data. |
August 7, 2026 is the date we first published this list. Supabase, Cloudflare, and Pipedream processed data before that date. The OpenAI row and the Exa row apply only where the named feature is enabled for the deployment you use. Where the feature is off, the Service makes no call to that provider. A row marked “Pending” describes a provider that is contracted but that does not yet process production data. We change the row to an effective date when processing starts, and we send the notice described in Section 2 before that date. PostHog is listed from August 19, 2026, and landing capture started with the next production Worker release after that date. Signed-in product events start with the production release that follows this notice. Stripe and Postmark stay pending until those features process production data.
2. Change Notice and Objection
We notify you before a new subprocessor starts to process customer data. We send the notice by the legal-update mechanism described in Section 10 of the Privacy Policy: we publish the updated list on this page with a new “Last updated” date, and we send a notice by email or in the Service.
You may object to a new subprocessor within 30 days after the notice. Send the objection to support@omnim.ai and state your reason. We answer the objection and, if we cannot offer a change that removes your reason, you may terminate the affected part of the Service.
3. International Transfers
Where a provider processes personal data outside the European Economic Area or the United Kingdom, we use the European Commission Standard Contractual Clauses, together with the United Kingdom International Data Transfer Addendum where United Kingdom law applies. Section 8 of the Privacy Policy states the same mechanism.
4. Contact Us
If you have questions about this list, contact us at support@omnim.ai.