Current Subprocessors
SiteGPT uses the following third-party service providers (subprocessors) to deliver our services. This list is maintained in accordance with our Data Processing Agreement obligations.
Last Updated: July 2026
Infrastructure & Hosting
| Subprocessor | Purpose | Location |
|---|
| Cloudflare, Inc. | Application hosting, content delivery, file storage, and security | Global |
| Prisma Data, Inc. | Database hosting (PostgreSQL) | United States, Europe |
Data Storage & Processing
| Subprocessor | Purpose | Location |
|---|
| Convex, Inc. | Backend database and application platform | United States (AWS) |
| Pinecone Systems, Inc. | Vector database for AI embeddings | United States (AWS) |
| Upstash, Inc. | Redis caching and queue processing | United States (AWS) |
AI & Machine Learning
| Subprocessor | Purpose | Location |
|---|
| OpenAI, L.L.C. | AI language model processing | United States |
| Cohere Inc. | AI embeddings and language processing | United States |
Content Processing
| Subprocessor | Purpose | Location |
|---|
| Firecrawl | Web content scraping and processing | United States |
| Supadata | YouTube content processing | United States |
Observability & Analytics
| Subprocessor | Purpose | Location |
|---|
| Portkey AI | AI observability and logging | United States |
| PostHog | Product analytics | United States |
| DataFast | Marketing analytics (cookieless) | United States |
Email & Communications
| Subprocessor | Purpose | Location |
|---|
| Bento | Email marketing and communications | United States |
| AutoSend | Transactional email delivery | United States |
| Loops | Transactional email delivery | United States |
Payments
| Subprocessor | Purpose | Location |
|---|
| Paddle | Payment processing (Merchant of Record; acts as an independent controller for payment data, not a subprocessor) | United Kingdom |
PHI Processing (HIPAA Deployments)
For customers with an executed Business Associate Agreement (see /legal/baa and /hipaa), PHI is scoped to end-user conversations (chatbot training content remains PHI-free by agreement), which restricts Protected Health Information to a minimal subprocessor chain, each member operating under its own BAA with SiteGPT before your BAA is executed:
| Subprocessor | Role in the PHI path |
|---|
| Convex, Inc. | Application database (conversations, chatbot content) |
| OpenAI, L.L.C. | AI responses and embeddings, zero-data-retention endpoints only |
| Pinecone Systems, Inc. | Vector search over chatbot content |
PHI does not flow to any other subprocessor on this page. These boundaries are enforced as preconditions of enablement: HIPAA processing is turned on for an account only once AI processing routes exclusively to OpenAI under zero data retention, conversation traffic is served directly from Convex infrastructure rather than through SiteGPT's general content delivery network, training content is confirmed PHI-free by agreement (which keeps content ingestion and queue subprocessors out of PHI scope), and notifications to observability, analytics, and email subprocessors carry no PHI (human handover notifications link agents to the dashboard instead of embedding conversation details). Until an account completes enablement, no PHI is permitted on it at all (see /hipaa).
Changes to Subprocessors
We provide at least 30 days' advance email notice to affected customers before adding or replacing a subprocessor that processes personal data on their behalf, and we update this page at the same time. Customers with a Data Processing Agreement in place may object as described in the DPA at /legal/dpa.
Questions
If you have questions about our subprocessors or data processing practices, please contact us at support@sitegpt.ai.