Fleece AI Sub-processors List
Fleece AI uses a carefully selected set of third-party sub-processors to deliver our autonomous AI agent platform. In accordance with the GDPR (Article 28), we maintain this transparent list of every sub-processor that processes personal data on behalf of Fleece AI. The table below states the Data Processing Agreement (DPA) status of each one, including any still pending. We evaluate each provider for security posture, data handling practices, and compliance certifications before onboarding. Our sub-processor list is reviewed quarterly and updated whenever providers are added, replaced, or removed.
Last updated: August 10, 2026
| Sub-processor | Purpose | Location | DPA |
|---|---|---|---|
| Neon (Neon Inc.) | PostgreSQL database hosting — stores all application data | United States (AWS us-east-1) | ✓ In place |
| Vercel Inc. | Application hosting, edge functions, analytics | Global CDN (primary: United States) | ✓ In place |
| Stripe Inc. | Payment processing, subscription billing, invoicing | United States | ✓ In place |
| Resend Inc. | Transactional email delivery | United States | ✓ In place |
| Mistral AI | AI model inference (Mistral Medium 3.5) — processes user prompts and agent tasks | France (EU) | ✓ In place |
| OpenAI, Inc. | AI model inference (GPT models) — processes user prompts and agent tasks | United States | ✓ In place |
| Anthropic PBC | AI model inference (Claude models) — processes user prompts and agent tasks | United States | ✓ In place |
| OpenRouter, Inc. | AI model routing for Kimi K3, Qwen 3.8 Max, GLM 5.3 Flash and DeepSeek V4.1 Flash — processes user prompts and agent tasks; forwarded only to inference providers that do not retain or train on data | United States | Pending |
| Modal Labs, Inc. | GPU infrastructure for our self-hosted open-weights model endpoints (standby since September 2026) — processes user prompts and agent tasks when enabled | United States | Pending |
| Exa Labs, Inc. | Web search for agents — receives the search queries agents send | United States | Pending |
| Steel (Steel Dev, Inc.) | Cloud browser sessions for agents' browser automation — processes the pages and form data agents work with | United States | Pending |
| Pipedream Inc. | Third-party app integrations and managed OAuth connections | United States | ✓ In place |
| Google LLC | OAuth authentication (Google Sign-In), Google Analytics 4 (with consent), Google Tag Manager, Google Ads conversion tracking | United States / Global | ✓ In place |
| GitHub Inc. (Microsoft) | OAuth authentication (GitHub Sign-In) | United States | ✓ In place |
| Microsoft Corporation | OAuth authentication (Microsoft Entra ID Sign-In), Microsoft Clarity session analytics and Bing Ads (UET) conversion tracking (with consent) | Global | ✓ In place |
| PostHog, Inc. | Product analytics (client events with consent, server-side events) | European Union (EU cloud) | Pending |
| X Corp. | Advertising conversion tracking (X pixel, loaded through Google Tag Manager) | United States | Pending |
| Cloudflare, Inc. | Edge worker relaying Clicky voice-assistant audio and requests | Global | Pending |
| Cal.com, Inc. | Demo booking (name, email and meeting details you submit) | European Union (cal.eu) | Pending |
How Your Data Flows
- User prompts and agent tasks are sent to AI providers (OpenAI, Anthropic) for inference only — your data is never used for model training.
- When you connect third-party apps (e.g., Google Calendar, Slack), your data passes through Pipedream's managed OAuth infrastructure.
- All application data is stored in Neon PostgreSQL with encryption at rest.
- Transactional emails are delivered through Resend. Only the recipient email and message content are shared.
- Payment data is processed entirely by Stripe. We never store credit card numbers.
Changes to This List
We will update this page when we add or remove sub-processors. Significant changes will be communicated via email to active account holders.
Questions about our data processing practices? Contact us at loicjane@fleeceai.agency