$ cat SUBPROCESSORS.md
Subprocessors
Third-party service providers that process personal data on behalf of Kommit AI. We select providers with strong data protection practices and maintain Data Processing Agreements with each.
| Subprocessor | Purpose | Data Processed | Location |
|---|---|---|---|
| Anthropic | AI conversations & PRD generation | Conversation messages, project context | United States |
| OpenAI | Text embeddings for semantic search (RAG) | Node content, messages | United States |
| Hetzner | Application hosting (servers + deployment via Dokploy) | All application data in transit and at rest on application servers | Germany (EU) |
| Vercel Blob | File storage (uploaded zip imports, assets) | Uploaded files | United States |
| Neon | Managed PostgreSQL database | All persisted data | United States |
| PostHog | Product analytics & error tracking | Usage events, user identity | European Union (Frankfurt) |
| GitHub | OAuth authentication, repository integration | Auth tokens, repository code | United States |
| Stripe | Payment processing | Billing information, email | United States |
| Langfuse | AI observability & tracing | AI request traces, token usage | European Union (Germany) |
| Botcruncher | Bot detection & ad fraud prevention | Traffic patterns, IP metadata, behavioral signals | European Union |
| Cal.com | Demo scheduling (book-a-demo) | Name, email, company, role, meeting metadata | United States |
Last updated: May 30, 2026
We will update this page when subprocessors change and notify affected customers by email at least 30 days in advance of any new subprocessor being engaged.
Questions? Contact us at privacy@getkommit.ai