/legal · sub-processors
Sub-processors
The third parties markoto engages to process personal data on our behalf, with the location, transfer mechanism, and public links for each. Required disclosure under GDPR Article 13(1)(e). We notify workspace-owner customers at least 30 days in advance of any new sub-processor.
OVHcloud (Managed PostgreSQL)
European UnionPrimary application database, Y.js document state, knowledge embeddings
- Transfer
- Intra-EU (no transfer)
- Privacy
- https://www.ovhcloud.com/en/personal-data-protection/
- DPA
- https://storage.gra.cloud.ovh.net/v1/AUTH_325716a587c64897acbef9a4a4726e38/contracts/9eb5c3d-DPA-9.0-2024-09-30.pdf
OVHcloud (Object Storage)
European UnionImage uploads, knowledge-base originals (deleted post-processing), database backups
- Transfer
- Intra-EU (no transfer)
- Privacy
- https://www.ovhcloud.com/en/personal-data-protection/
- DPA
- https://storage.gra.cloud.ovh.net/v1/AUTH_325716a587c64897acbef9a4a4726e38/contracts/9eb5c3d-DPA-9.0-2024-09-30.pdf
Mistral AI SAS
European UnionAI text generation for the writing assistant (Mistral Small) and voice transcription (Voxtral)
- Transfer
- Intra-EU (no transfer)
- Privacy
- https://mistral.ai/terms/#privacy-policy
- DPA
- https://mistral.ai/terms/#data-processing-agreement
Jina AI GmbH
European UnionEmbedding generation for knowledge-base RAG; single-URL page content extraction for the fetch-URL tool (Jina Reader)
- Transfer
- Intra-EU (no transfer)
- Privacy
- https://jina.ai/legal/#privacy-policy
- DPA
- https://jina.ai/legal/#data-processing-agreement
Staan (European Search Perspective SAS)
European UnionWeb search for the AI writing assistant, via a proprietary European search index (EU-only routing)
- Transfer
- Intra-EU (no transfer)
- Privacy
- https://staan.ai/privacy
Black Forest Labs GmbH
European UnionImage generation via FLUX.2 (EU-pinned data plane)
- Transfer
- Intra-EU (no transfer)
- Privacy
- https://blackforestlabs.ai/privacy-policy/
- DPA
- https://blackforestlabs.ai/data-processing-agreement/
Google LLC (OAuth)
United States DPFSign-in via Google account (no other Google data accessed)
- Transfer
- EU-US DPF (SCCs as fallback)
- Privacy
- https://policies.google.com/privacy
GitHub, Inc.
United States DPFSign-in via GitHub account (no other GitHub data accessed)
- Transfer
- EU-US DPF (SCCs as fallback)
- Privacy
- https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement
- DPA
- https://docs.github.com/en/site-policy/privacy-policies/github-data-protection-agreement
Stripe, Inc. (and Stripe Payments Europe Ltd.)
Global DPFSubscription billing, payment method storage, invoice generation, fraud scoring
- Transfer
- EU-US DPF (SCCs as fallback)
- Privacy
- https://stripe.com/privacy
- DPA
- https://stripe.com/legal/dpa
Functional Software, Inc. (Sentry)
Global DPFApplication error + performance telemetry, stored in Sentry's EU (Frankfurt) data region
- Transfer
- EU-US DPF (SCCs as fallback)
- Privacy
- https://sentry.io/privacy/
- DPA
- https://sentry.io/legal/dpa/
Resend, Inc.
Global DPFTransactional email delivery — account-deletion confirmations, data-export-ready notifications, breach notifications
- Transfer
- EU-US DPF (SCCs as fallback)
- Privacy
- https://resend.com/legal/privacy-policy
- DPA
- https://resend.com/legal/dpa