Subprocessors
Everywhere customer data goes, and what goes there. Four entries, two of them ours.
Who processes what
| Subprocessor | Purpose | What reaches them |
|---|---|---|
| RenviqLogaXP | The database. Every record, every event, every generated document. | All of it, including restricted fields. |
| RelyKit → AWS SESLogaXP | Transactional email. | Recipient addresses, subject, body, and any attached document. A template that puts a restricted field in a body does not compile, so what reaches them is bounded by what publishes. |
| Anthropic or OpenAIConfigured by you | Designing a process, and the operational copilot. | The process schema, never its contents. Nothing at all unless a key is configured. |
| Your own webhook endpointsYou | Sending events to systems you run. | Only the fields the process names, and it refuses to name restricted ones. |
The row people ask about
A model receives the shape of a process — state names, field names and labels, task and approval names — and never the answers inside it. Asked an operational question, the model returns a typed plan; a deterministic compiler resolves that plan and runs the query, and the rows that come back do not go to the model.
This is why the plan language exists. Records contain free text that respondents typed, so feeding them to a model would mean feeding it attacker-controlled input on every question.
The longer version is on the privacy page.
What is not met
Named rather than implied.
- No advance-notice commitment. There is no published process for telling customers before a subprocessor is added or changed.
- Data residency is inherited rather than chosen. Each subprocessor’s region is whatever it is configured with; there is no per-workspace control.
- No signed data processing agreements to publish yet.