Subprocessors
Effective August 6, 2026 · Last updated August 6, 2026
Draft — pending legal review. The list below reflects the services the product genuinely depends on. Hosting regions and entity details are marked with placeholders and must be confirmed before this is relied upon.
We use the third parties below to run ContextHive. Each processes personal data on our behalf, under contract, and only to provide their service to us.
If you're evaluating us for a security or procurement review, this is the page to read. We'd rather it be complete than short.
Infrastructure
| Subprocessor | What it does | Data it can see | Location |
|---|---|---|---|
| [HOSTING PROVIDER] | Runs the web application | All application data in transit; server logs | [REGION] |
| [DATABASE PROVIDER] | Hosts the Postgres database | All stored data: accounts, conversations, contacts, knowledge base | [REGION] |
| Cloudflare | Chat widget delivery, realtime messaging (Workers, Durable Objects), attachment storage (R2) | Widget conversation content in transit; uploaded attachments at rest | Global edge network |
AI
| Subprocessor | What it does | Data it can see | Location |
|---|---|---|---|
| OpenRouter | Routes AI requests to model providers | Conversation content and knowledge base passages included in agent prompts | United States |
| Underlying model providers | Generate replies, titles and embeddings | The same content, as forwarded by OpenRouter | Varies by model |
Read this bit twice if you're doing a compliance review. When the AI agent is enabled, conversation text and the retrieved passages from your knowledge base are sent outside our infrastructure to be answered. Which model provider receives it depends on the model your workspace has selected.
We select providers that contractually agree not to train on submitted content.
If your workspace sets the agent mode to off, no conversation content is sent for reply generation. Some workspaces run this way for exactly this reason, and that's a legitimate way to use the product.
Operations
| Subprocessor | What it does | Data it can see | Location |
|---|---|---|---|
| Stripe | Subscription billing and payments | Billing contact details, payment method (held by Stripe, never by us), invoice history | United States / global |
| Resend | Sends outbound email — replies, invitations, notifications | Recipient addresses and email content | United States |
| Inngest | Runs background jobs (AI replies, knowledge indexing, analytics) | Job payloads containing record identifiers | United States |
Changes to this list
We'll update this page before adding a subprocessor that handles customer personal data. If you'd like advance notice by email, write to [CONTACT EMAIL] and we'll add you to the list.
Questions
Security questionnaires, DPAs and specific questions: [CONTACT EMAIL].
We're a small team and we are not currently SOC 2 or ISO 27001 certified. If your procurement process requires either, we're not the right fit yet, and we'd rather say so now than waste a month of your time.