# Subprocessors and service providers Last updated 20 September 2026. ## About this register This register describes infrastructure and optional recipients used by Agentik. A company may act as a processor for some activities and an independent controller for others, particularly authentication, payments and advertising. The applicable contract determines that role. Vendor headquarters are not a promise of data residency; actual processing locations and transfer arrangements depend on the configured service. ## Vercel: website, workflows and AI Gateway Hosts the website and server-side web application, supplies site analytics, and provides the optional support workflow and AI Gateway. Depending on the feature, it processes web requests, device and usage information, session references, support conversations and permitted account context. AI Gateway can route a support request to a model provider. Availability of contractual safeguards depends on the subscribed service and plan. - [Vercel DPA](https://vercel.com/legal/dpa) - [AI Gateway privacy and security](https://vercel.com/docs/ai-gateway/security-and-compliance) ## Cloudflare: API, MCP and database connections Runs the API and MCP service in Workers, applies request limits and connects the API to PostgreSQL through Hyperdrive. It processes request traffic, authentication material, tool payloads in transit, security metadata and database traffic required for those services. - [Cloudflare DPA](https://www.cloudflare.com/cloudflare-customer-dpa/) ## Neon: PostgreSQL database Stores application records, including accounts and workspace memberships, hashed credentials, authorisations, billing and execution metadata, security events, support-assistant references and human Help and Support messages. The database region and backup retention depend on the production project configuration; this notice does not assert a verified EU-only location. - [Neon security and data processing](https://neon.com/security) ## Clerk: authentication Processes sign-in identity, email address, authentication factors and session/security information to authenticate users. Clerk is separate from the Neon application database. Agentik receives the verified identity needed to link an account to workspace permissions. - [Clerk DPA](https://clerk.com/legal/dpa) ## Stripe: payments Processes hosted Checkout, payment and billing details, fraud signals and transaction information. Agentik retains the references and accounting information needed to credit a workspace and reconcile payments. Stripe may act as an independent controller for activities described in its own terms. - [Stripe DPA](https://stripe.com/legal/dpa) - [Stripe privacy policy](https://stripe.com/privacy) ## AI model providers: optional support When you use the support assistant, your messages and authorised account context are sent through AI Gateway to the configured model provider. The repository’s default support model is supplied by OpenAI; deployment settings and gateway routing can change the selected provider. Confirm the provider and routing arrangements with us before submitting personal data that requires a specific processing agreement. We do not promise zero retention across all model providers. - [OpenAI business data processing](https://openai.com/policies/data-processing-addendum/) ## PostHog: optional product analytics PostHog receives consented, limited page and product-action events, campaign parameters, account and workspace identifiers, execution outcome metadata and payment amounts. Browser capture excludes credentials, form contents, URL query strings and fragments, and tool inputs and outputs. Session replay and automatic interaction capture are disabled. Analytics use the configured PostHog EU project; the provider’s terms describe its processing and transfers. - [PostHog privacy](https://posthog.com/privacy) ## Google Analytics: optional audience and conversion measurement Google receives consented page views, reviewed campaign labels, referrer origins, browser and session identifiers, limited device information and server-confirmed conversion milestones, including payment amounts and currency. We exclude email addresses, credentials, form contents, private authorization URLs and tool inputs and outputs. Automatic interaction measurement, Google Signals and advertising personalization are disabled. Google's terms describe its processing, retention and international transfers. - [Google privacy](https://policies.google.com/privacy) - [Google Analytics data processing terms](https://business.safety.google/adsprocessorterms/) ## Discord: account notifications and human support Configured Discord channels receive registration and confirmed-payment notifications for authorised staff. When trial notifications are enabled, they also receive trial-credit decisions, limited matching indicators and operator review notes. These messages contain limited account and transaction information, not authentication secrets, payment-card details or tool payloads. When human Help or Support is enabled, separate private channels receive customer messages, staff replies, conversation status, page path and any optional visitor name or email. App Support also includes the authenticated user and workspace identifiers on each message. Only authorised operators can use the customer-reply controls; ordinary Discord discussion stays internal. - [Discord privacy](https://discord.com/privacy) ## Resend: email delivery When email delivery is configured, Resend processes recipient and sender addresses and the content of authentication messages, invitations, welcome messages, payment confirmations and alerts. Selected authentication codes originate from Clerk. The application temporarily stores encrypted message payloads in an email queue, erases them after sending, cancellation or expiry, and retains delivery metadata. Resend does not receive all tool requests merely because email delivery is enabled. Resend also delivers optional setup help, trial reminders, product tips and feedback requests unless you have turned them off. Delivery, bounce and complaint events are used to monitor these messages and suppress further reminders when appropriate. - [Resend DPA](https://resend.com/legal/dpa) ## Selected tool providers Only the provider needed for a requested tool receives that tool’s request, subject to the provider’s own downstream processing. For example, DataForSEO handles requested search and SEO data operations; Leadsforge and Icypeas handle requested lead discovery, verification or enrichment. A listed but unavailable provider is not evidence that Agentik can currently send it requests. Inspect the provider and tool pages before use. - [Full tool-provider catalog](/providers) ## X: optional advertising When X measurement is configured and you accept marketing, X can receive page visits, confirmed account and purchase conversions, payment values in USD, ad click identifiers and browser/network information. Server-to-server delivery also requires recorded marketing consent. This is an optional advertising recipient, not part of the tool-execution database. You can reject or withdraw marketing consent through Cookie settings. - [X privacy policy](https://x.com/en/privacy) --- [HTML page](/subprocessors) · [Agent index](/llms.txt)