Subprocessors
Last updated: May 10, 2026
Version: 2026-05-10
Draft notice: Keep this list aligned with the engineering inventory at
legal/DATA_FLOWS_AND_SUBPROCESSORS.mdin the Knotr AI source repository. Verify hosting region and production object storage in the deployment configuration before publishing.
A subprocessor is a third-party vendor that processes personal data on our behalf to provide the Service. We use a small set of subprocessors and try to keep the list short. We will update this page when we add or remove a subprocessor and, where contractually required, notify customers in advance.
Current subprocessors
| Subprocessor | What they do | Data they may process | Notes |
|---|---|---|---|
| DigitalOcean | Application runtime, PostgreSQL database (with pgvector), background jobs (SolidQueue) | All categories described in the Privacy Policy — at rest in our database | Region: NYC3 (New York, USA). Backups are stored in the same region. |
| OpenAI | Generates document embeddings (EmbeddingService), powers in-product Skill AI chat (SkillAiService), and runs skill-execution prompts |
Text chunks from your User Content; prompts and retrieved knowledge | Configured per OPENAI_API_KEY and related env. Knotr uses OpenAI’s standard API only, where OpenAI’s API data-usage policy states inputs and outputs are not used to train OpenAI’s models. |
| Stripe | Payments, subscriptions, and the customer billing portal | Billing email, address, payment method metadata, Stripe customer/subscription IDs, invoice history | Card data is handled directly by Stripe; full card numbers do not hit Knotr’s servers. |
| Mailgun | Transactional email (account, billing, invitations) | Recipient email address, message content | Used in staging and production where configured. |
| Scout APM | Application performance monitoring | Request paths, timings, error stack traces; we configure instrumentation to avoid sending raw User Content | When enabled in production. |
| DigitalOcean Spaces (S3-compatible object storage) | File uploads via Active Storage | Uploaded file bytes and Active Storage metadata | Region: NYC3 (New York, USA). Used in both staging and production. |
Not subprocessors
When you connect a third-party MCP host, AI assistant, IDE, or other client to your Knotr account using an API key, OAuth, or MCP credentials, that third party processes your data under its own privacy policy. It is not a Knotr subprocessor. You can revoke any client at any time from your account settings.
Changes
When we add or remove a subprocessor, we will refresh the Last updated date above and bump Legal::TERMS_VERSION if the change is material. Customers who have signed our Data Processing Agreement and require advance notice should subscribe to subprocessor updates as described there.
Adapted from the Basecamp open-source policies under the Creative Commons Attribution 4.0 license. Modifications and Knotr-specific sections are © Knotr AI, LLC.