The vendors below may process Customer Data on Rahoto's behalf to deliver the Service. AI providers receive only the restricted, redacted input needed for their task, never raw customer rows, and do not train on Customer Data. Bring-your-own AI model endpoints are configured by you and are not Rahoto sub-processors. We give at least 30 days' notice before adding a sub-processor — subscribe at[email protected] to be notified.
| Sub-processor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Primary compute and database hosting | EU (Germany / Finland) |
| S3-compatible object storage | Report assets, exports, and snapshots | EU |
| Stripe | Subscription billing and payment processing | EU / US (SCCs) |
| Transactional email provider | Account, verification, and delivery notification emails | EU |
| Error & uptime monitoring | Operational diagnostics and incident response | EU |
| Anthropic (Claude API) | Primary report-reasoning provider — receives redacted summaries and profiles only, never raw rows; Customer Data is not used for training | US (SCCs) |
| Google (Gemini API) | Configured multimodal and design provider — receives the same restricted, redacted input and never raw rows; Customer Data is not used for training | EU / US (SCCs) |
| OpenAI (OpenAI API) | Configured alternative or failover AI provider — receives the same restricted, redacted input and never raw rows; Customer Data is not used for training | US (SCCs) |
| Recraft | Editable-vector artwork generation when enabled — receives the artwork prompt and redacted design context, never raw customer datasets | Provider-controlled; contractual region confirmed before activation |
Notifications
To receive advance notice of changes to this list, email[email protected] with the subject "subprocessor notifications". Enterprise customers receive notices to their designated security contact.
Related
See the Data Processing Agreement,Privacy Policy, andTrust Center for how this data is protected.