Last updated October 6, 2026
This page lists the third-party companies ("sub-processors") that Atlaso Labs Inc. ("Atlaso", "we", "us", "our") uses to help operate the Atlaso memory layer (the "Service"). A sub-processor is an outside vendor we engage to process personal data on our behalf (for example, the companies that host our servers, store your account details, process your payments, or run the AI features described in our Privacy Policy). We share with each sub-processor only the data it needs to perform its function, we vet each one for appropriate security and privacy practices, and we rely on each provider's data-processing terms to protect your data. This page is kept current and lists every production sub-processor that handles personal data as part of delivering the Service.
For how we collect and use personal data overall, see our Privacy Policy. This page supplements that policy and the data-protection terms in our Data Processing Addendum.
To run Atlaso, we rely on specialized infrastructure and service providers rather than building everything ourselves. When one of those providers stores, transmits, or otherwise processes personal data on our instructions to help us deliver the Service, that provider is a "sub-processor."
Atlaso acts as the data controller (or, for business customers under a Data Processing Addendum, as a processor) of the personal data you provide. Our sub-processors act on our behalf and are permitted to use the data only to provide their service to us, not for their own independent purposes, except where a provider acts on its own account for some data under its own terms: for example, Stripe for its fraud-prevention and financial-regulation duties, and Google for Google signals and the other Google Analytics settings described in our Cookie Policy.
The personal data we handle is described in detail in our Privacy Policy. In summary it can include: your account identity (email, name, and user id), authentication credentials (including passkeys), your subscription and plan status, a server-registered device identifier, payment and billing information, and, most importantly, your Memory content (the facts, decisions, preferences, and automatically captured conversation snippets that Connectors create or that you save). Your Memory content is stored on Atlaso's servers so it can sync across your sessions and devices, with a local copy also kept on your machine by some tools (currently Claude Code, Codex and Antigravity); it is therefore handled by some of the sub-processors below.
Before we engage a sub-processor, and on an ongoing basis, we assess each one for its suitability to handle the data we entrust to it. Our diligence includes, where applicable:
We rely on each provider's data-processing terms for the data-protection obligations that apply to it. For example, we accepted the Google Analytics Data Processing Terms on July 21, 2026. For some providers, including those named in Section 5, we currently rely on their published terms while we formalise those protections in a contract.
The following third parties process personal data to help us provide the Service. This list is current as of the "Last updated" date above.
| Sub-processor | Purpose | Categories of data processed | Processing location / HQ |
|---|---|---|---|
| Clerk | Authentication, session management, and user-profile storage | Email address, Atlaso user id, first/last name, passkeys, plan status (free/paid) and Stripe customer-id metadata; your profile and settings choices (avatar, the optional "your work" role including any text you type, privacy settings, onboarding status); records of support, review (including your star rating) and waitlist requests; for each sign-in session, the browser, device type and an approximate city and country worked out from the IP address; and, unless you turn off "Use my approximate location" in Settings (it is on by default), the approximate city and region of your last dashboard visit. Clerk creates your one-time sign-in codes. | United States |
| Stripe | Payment processing and subscription billing | Email address, your Atlaso user id (as a customer reference), card and payment data, billing address, and subscription state. After you delete your account, Stripe keeps the customer record (marked deleted) and its invoices as our billing record. (Full card numbers and security codes are handled by Stripe only and do not touch Atlaso's systems; Atlaso receives only the card brand, last four digits and expiry date, to show them in Settings and in billing emails.) | United States |
| Neon | Brain/metadata database (Postgres) and transient enrichment queue | Authentication-token hashes; device registry (server-minted device_id, device name, which by default is your computer's hostname, connected tools, last-seen); plan status; content-free usage records; sign-in connection (OAuth) records; forget records (Memory ids, no text); the campaign details recorded at signup (UTM tags, an ad click id if any, referrer and landing page); the cached dashboard greeting and Ambient Memory summaries, which contain words taken from your Memories; capture text waiting to be processed, which is blanked once processed; and, after an account is deleted, a one-way hash of its account id so the deletion can be re-applied. Neon keeps a 7-day recovery history of the database. | United States (AWS us-east-1, N. Virginia) |
| Fireworks AI | Model provider for the dashboard greeting and Ambient Memory summaries on every plan, including Free; on Pro, also Memory enrichment (including Memories saved before you upgraded) and Ask; Ambient distillation for connected tools only if we switch it on; optional headlines and labelling if we switch them on | Selected stored Memory text and, for Ask, your question, processed on open models on Fireworks' serverless platform with zero data retention. Fireworks does not log or store this text: it exists only in memory while the request runs, and prompt caching may keep some of it for a few minutes. Fireworks keeps only technical metadata, such as token counts, and does not use this text to train or improve its models, because that requires an explicit opt-in, which Atlaso has not given. Recognized secrets are removed from Memory when it is captured. | United States (Fireworks servers) |
| OpenRouter, Inc., routing MiniMax M3 requests only to Together AI, CoreWeave or ModelRun | Optional Ask Atlaso product-question assistant on the marketing website | The visitor's question and recent questions and answers in the same conversation. Atlaso does not attach stored Memories, account records or dashboard data; visitors may type personal data themselves. Requests specify zero-data-retention routing, deny provider data collection and allow no fallback to other hosts, and the OpenRouter workspace that serves Ask Atlaso has prompt logging switched off. | Processing location not verified (OpenRouter and the three downstream hosts) |
| Render | Hosting for the Atlaso brain/API and its scheduled jobs | All server-side data at rest, including stored Memory content, account and device metadata, and service and request logs. This includes the search text sent when Claude Code, Codex or Antigravity search your memory: it is stored without secret scrubbing for about 30 days (longer if the result was rated) and may appear in server request logs. Cursor and OpenCode scrub search text before sending it; OpenCode's scrubbed search text is also stored for about 30 days. Traffic to our API at mcp.atlaso.ai passes through Cloudflare's network, which Render uses. | United States (Virginia, US East) |
| Backblaze, Inc. (B2 Cloud Storage) | Encrypted off-site backups | Encrypted backup copies of our account database (Neon), which holds account, device and plan data; backups may also include copies of the Memory stores, which hold stored Memory content. Each copy is encrypted by Atlaso before upload with a key only Atlaso holds, so Backblaze cannot read it. Daily copies are locked for 14 days, weekly copies for 35 days and monthly copies for 93 days, and each is deleted automatically one to two days after its lock ends, so every copy is gone within about 94 days. | United States (US East) |
| Vercel | Hosting for the Atlaso website (atlaso.ai) and dashboard (app.atlaso.ai); cookieless page counting (Vercel Web Analytics) on both, and page-speed measurement (Vercel Speed Insights) on the website | Web request data and served content, including Memory content that passes through the dashboard's server functions when you view, search, ask or export, and server logs that can include your Atlaso user id. For measurement: the page address, referring page, browser, operating system, device type, approximate location and page-load timings. Nothing is stored in the visitor's browser. | United States (servers in the Washington, D.C. area); requests first reach the Vercel edge location nearest you |
| Upstash, Inc. (Upstash Redis) | Rate limiting and abuse protection for the website's Ask Atlaso assistant, contact form and plan waitlist (Notify me), and temporary storage for email sign-up confirmations | A keyed hash of the visitor's IP address combined with the date (not the IP address itself), kept up to 48 hours; a one-way hash of an email address and the plan asked about, kept 24 hours to allow one waitlist sign-up a day; and, while an email sign-up awaits confirmation, the email address itself, stored against a hashed confirmation code for up to 24 hours | India (AWS Mumbai) |
| Cloudflare, Inc. | Cookieless page counting and page-speed measurement (Cloudflare Web Analytics) on the website and dashboard | The page address, referring page, browser and device details, and page-load timings. Cloudflare does not log query strings. Nothing is stored in the visitor's browser. | United States |
| Google LLC (Google Analytics) | Website and product analytics (aggregate usage measurement) | Online identifiers (cookie IDs), detailed device and browser information (such as device model and browser version), pages viewed, approximate (city-level) location, and, for signed-in dashboard users, a pseudonymous user id and plan tier. Google signals is switched on, so Google may associate visits with the Google accounts of signed-in users who have allowed this. Data is kept for 14 months. Loaded on the website and the dashboard only after a visitor presses Accept all in our cookie banner, and never where a browser sends Global Privacy Control. | United States (SCCs / EU–US Data Privacy Framework; Google is DPF-certified) |
| PostHog, Inc. | Product analytics for the marketing website and the dashboard; heatmaps and session replay on the marketing website only (never the dashboard) | On the marketing website: online identifiers (a randomly generated visitor id), device/browser info, pages viewed, and the interactions we measure: how far a page was scrolled, which FAQ was opened, whether a form succeeded. For visitors who press Accept all in our cookie banner it may also record a session replay of movement through a page. No Memory content and no account data are sent from the website. Every input is masked, and the contact form and Ask Atlaso box are excluded from recording entirely, so no text a visitor types is ever captured. For website visitors who have not pressed Accept all, PostHog stores nothing in the browser, retains no identifier beyond the tab, and records no replay, but it still receives their events and works out an approximate location from the IP address before discarding the address. On the dashboard (app.atlaso.ai): product-usage events about sign-up, setup and upgrade steps, identified by the pseudonymous Atlaso user id (never name or email), with properties limited to the event type, the page path with ids removed, the tool connected, plan and billing interval, number of connected tools, sign-up date, a memory count, the setup step, screen or button involved, the cookie-banner answer, and standard browser and device details. Never Memory content, searches, questions or anything typed. No session replay and no automatic click capture on the dashboard. Requests pass through app.atlaso.ai/ingest, which removes cookies and sign-in credentials. On the dashboard, without Accept all, nothing is stored in the browser and PostHog is told not to derive a location from the IP address. Where a browser sends Global Privacy Control, PostHog does not load on the website or the dashboard. One server-side event when a Pro subscription starts (plan and billing interval) is sent regardless of browser settings. Our PostHog project discards IP addresses after any location is worked out; events are kept for one year and session replays for 30 days. | United States (US Cloud) |
| Sentry (Functional Software, Inc.) | Error and crash monitoring for the dashboard and brain/API | Error events, stack traces, page or API routes and technical browser, device and service details. Atlaso configures Sentry not to store IP addresses in error events and does not attach an account id, email address or name. Memory content and request bodies are not intentionally sent. | United States |
| Resend (Resend, Inc.) | Email delivery: sign-in codes and other account-security emails where these are sent through Resend rather than by Clerk; the welcome email; payment receipts, refund and card-expiry notices and other billing emails; acknowledgements of support, feature and review messages and of contact-form messages; waitlist confirmations and updates for a plan you asked to hear about; product-update emails; and delivery of contact-form and waitlist messages to our support inbox | Email address, name, the content of the emails we send (a confirmation can quote the message you wrote to us) and, where sign-in codes are sent through Resend, those one-time codes. For a plan waitlist, your email address and name are kept on that plan's contact list until you ask to leave it. | United States |
| Google LLC (Google Workspace) | Our company email, including the support@atlaso.ai inbox | Messages you send us (including through our contact form and the dashboard's Support screen), with your name, email address and, from the dashboard, your Atlaso user id and plan; data-subject requests and our replies. Only Atlaso's founder has access to this inbox. | United States (HQ); Google may store email in its data centres in other countries |
| Mintlify, Inc. | Hosting for our documentation site, docs.atlaso.ai, including its AI assistant | Web request data from docs visitors, and any question typed into the docs search or AI assistant | United States (HQ in San Francisco); pages are served through Cloudflare's global network from a US East origin. Where the docs assistant's AI requests are processed: not verified |
We may add, remove, or replace sub-processors as the Service evolves. This page is the authoritative, current list. When we make a change, we update this page and revise the "Last updated" date at the top, and we surface material changes in-product and/or by email where available. If your organisation has signed our Data Processing Addendum, we also email the contact named in it before a new sub-processor is added. You can also check this page at any time, or contact us at support@atlaso.ai to ask about upcoming changes.
If you have a Data Processing Addendum with us, the notice period and your right to object to a new sub-processor are governed by that addendum. If you reasonably object to a new sub-processor on legitimate data-protection grounds, contact us at support@atlaso.ai and we will work with you in good faith to address your concern; if we cannot, you may have the right to terminate the affected part of the Service as described in the addendum.
The following items are being finalized and will be reflected in a future update of this page:
If you have questions about our sub-processors or how we handle your data:
Atlaso Labs Inc., a Delaware C-Corporation.
This Sub-processors List is provided for transparency and should be read together with our Privacy Policy, Terms of Service, and Data Processing Addendum.