Legal
To deliver the Chromoly platform we use a small number of third-party subprocessors that may process Customer Personal Data on our behalf. This page lists every subprocessor currently in use, what they do, and where data is hosted.
We require all subprocessors to maintain appropriate technical and organisational security measures, and we have signed Data Processing Agreements (DPAs) and Standard Contractual Clauses (SCCs) where required.
| Provider | Purpose | Data hosted in |
|---|---|---|
| Supabase DPA |
Database, authentication, storage, and core platform infrastructure. Hosts all Customer data and AppSpec definitions. | EU (Ireland) |
| Vercel DPA |
Hosting and edge delivery for the Chromoly platform and generated Customer applications. Logs and request metadata only - Customer Personal Data not stored at rest. | EU (Dublin, Ireland) — platform server functions Global CDN — static content and cached responses |
| Anthropic DPA |
AI model provider (Claude) used for AppSpec generation, classification, summarisation, and AI-powered automation steps. Inputs may include Customer-provided content; no training on your data. | US |
| OpenAI DPA |
Alternative AI model provider (GPT family) used as failover or when explicitly selected by the Customer. No training on your data. | US |
| Berget AI AB DPA |
AI inference for EU mode: planning, building, editing, in-app responses, agents, automations and safety checks. Processes the request content needed for the selected task. | EU (configured inference region) |
| Mistral AI Terms |
Legacy AI processing only where an existing configuration explicitly selects and enables the direct Mistral EU route. Berget AI is the current EU-mode provider. A Mistral model hosted by Berget does not itself send data to Mistral AI. | EU (France) |
| Google Analytics Data Processing Terms |
Website analytics and advertising conversion measurement for chromoly.io. Active only for visitors who accept analytics cookies in the consent banner. No Customer application data is sent to Google. | US |
| Stripe DPA |
Subscription billing, payment processing, and invoice management. | US (with EU data residency option) |
| Resend DPA |
Transactional email delivery - account verification, password reset, alerts, and Customer-configured workflow emails. | US |
| UptimeRobot Privacy |
Uptime monitoring and incident alerting for deployed Customer applications. Stores URL endpoints and uptime status only. | Global |
| GitHub DPA |
Source code hosting for generated Customer applications (private repositories per app). | US |
| Slack DPA |
Used as a delivery channel for Customer-configured workflow notifications when the Customer connects their Slack workspace. | US (with EU data residency option) |
Customer data and AppSpec definitions are stored on Supabase in the EU (Ireland). EU mode routes supported AI requests and safety checks through Berget AI in the configured EU inference region. If the required regional configuration or service is unavailable, the request stops; it does not silently switch to Global providers. Global-mode AI uses separately selected providers and may involve processing outside the EU.
EU mode describes the AI inference route, not the location of every platform service. Hosting, billing, support and Customer-connected integrations have their own processing scope and locations. Where personal data is transferred outside the EEA, the safeguards described in our DPA apply. Berget’s own subprocessors are listed in its DPA appendix.
We will update this page whenever a subprocessor is added, removed, or replaced. Material changes will be communicated to active Customers by email at least 30 days in advance of taking effect, giving Customers an opportunity to object before the change is applied.
To receive subprocessor change notifications, ensure your account email is current and that you have not opted out of operational communications.
If you object to a current or proposed subprocessor on legitimate data protection grounds, please contact us at hello@chromoly.io. We will work in good faith to find a resolution. Where no resolution is possible, you may terminate your subscription in accordance with our Terms of Service.