Subprocessors

About this page

Pagerox uses a small number of third-party vendors (subprocessors) to run the service. This page lists every one of them, what they process, why, and where. It is the authoritative subprocessor list referenced by our Data Processing Agreement (DPA).

When we add or replace a subprocessor, we announce the change on this page before the new vendor processes customer data. The DPA governs your right to object to a change.

Infrastructure

Vercel (USA): application hosting and serverless compute. Runs the Pagerox application, so all traffic to the service passes through it. Model calls are routed through Vercel's AI Gateway as part of this hosting.

Supabase (project region as configured, USA or EU): database, authentication, and file storage. Pagerox production is hosted on Supabase; it stores workspace configuration, account data, and the durable records the product keeps.

Upstash: rate limiting. Processes request metadata only, never content.

AI

OpenAI (USA): model inference. Processes prompts and the content needed to answer, in flight only, under API terms that prohibit training on customer data.

Anthropic (USA): model inference. Same footing as OpenAI: content in flight only, under no-training API terms.

Business operations

Stripe (USA): payments and billing. Processes payment and invoice data. Card data goes directly to Stripe and never touches Pagerox systems.

Resend (USA): transactional email. Processes recipient addresses and the content of notification emails we send you.

PostHog (EU): product analytics and error tracking. Receives scrubbed event names and metadata only, never message content.

Customer-directed services

The following services touch your data at your direction, under your own agreements with those providers. We list them here for completeness even though they are not subprocessors in the classic sense.

Slack (USA): your own Slack workspace. Pagerox employees read and send messages there via Slack APIs because you installed them; message content is processed in flight and governed by your Slack agreement.

Google (USA): optional sign-in. If you choose to sign in with Google, Google processes the authentication under your Google account terms.

Tool integrations (Composio, USA): when you connect a tool to an employee, the connection is authorized by you, scoped to that tool, and carried through the integration platform, which processes tool-call arguments and the OAuth tokens for the accounts you connect.

BYOK model keys: workspaces that bring their own model provider key make model calls under their own agreement with that provider. Those calls are not Pagerox subprocessing.

What no vendor receives

No vendor on this page receives raw message history at rest from Pagerox: Slack and email content is processed in flight and dropped, so there is no stored message archive to share.

No vendor receives card numbers from Pagerox, because Pagerox never holds them; card data goes directly to Stripe.

Objections

If you object to a subprocessor change, the DPA sets out your rights and the process. Raise an objection or ask a question at support@pagerox.com.