In short
- These are the companies that process customer data so we can run Sora Build.
- Services you choose to connect, like QuickBooks, aren't subprocessors: you decide to share data with them.
- We give workspace owners 30 days' notice before adding a subprocessor.
This summary is here to help. The full text below is what applies.
1. Current subprocessors
| Company | What they do for us | Data involved |
|---|---|---|
| Supabase, Inc. | Database, file storage and realtime updates | All Customer Data, including uploaded files |
| Clerk, Inc. | Sign-in, accounts and sessions | Names, email addresses, sign-in methods and session details |
| Cloudflare, Inc. | Hosting the app, network delivery and security, and storing messages and sign-ups sent through our contact page and the AI waitlist | Everything that passes through the app in transit, request logs, contact messages and AI waitlist sign-ups |
| Stripe, Inc. | Subscription billing for Sora Build, and the payment accounts companies use to take client payments | Billing contacts, company and invoice details, payment details |
| Resend, Inc. | Sending email: invitations, notifications and invoices | Recipient names and email addresses, and email content |
| OpenRouter, Inc. | Passing requests from the optional AI features, and from invoice-line matching, to the model that answers them, and only to model providers that don't store or train on what they're sent | What each request carries, as described in the next two rows. It doesn't store prompts or answers, or train on them |
| Anthropic, PBC | The Claude models behind the optional AI features on paid plans, run by Anthropic or for it on Amazon Web Services, Google Cloud or Microsoft Azure: drafting, summarizing and reading documents, only when someone uses them | The project information a feature needs for that request, such as tasks, dates, comments or an uploaded document. Not used to train its models |
| Google LLC | Website and product analytics (Google Analytics), only where analytics is allowed | A random browser identifier, an internal account id, the company's plan and the person's role, which pages and features are used (with company, project and link identifiers removed), and subscription purchases. No names, email addresses or project content |
| TypeSafe AI, Inc. | Matching the lines of an imported invoice to a company's price book | The description of each imported invoice line, without amounts. Not used to train its models |
These providers are based in the United States and process data in the United States and other countries where they operate.
OpenRouter and Anthropic process data only when someone in a workspace on a paid plan uses an AI feature, and not at all while a workspace admin has AI switched off. TypeSafe processes invoice line descriptions only when someone imports an invoice. We don't keep a copy of what's sent to them or what they send back.
2. Services you connect
When your company turns on an integration, it chooses to share data with that provider, under the provider's own terms. These are not our subprocessors.
| Service | When it's used |
|---|---|
| Intuit QuickBooks Online | When an admin connects your company's QuickBooks account |
| Your company's Stripe account | When an admin sets up online client payments, Stripe processes payments as your company's payment provider |
3. Planned additions
Some planned features will need a new provider. For example, text message notifications need an SMS provider. We'll add each one here, and notify workspace owners, at least 30 days before it starts processing customer data.
4. Getting updates
Workspace owners are notified by email about changes to this list. To ask a question or object to a change, write to us through our contact page. The Data Processing Addendum explains what happens if you object.