Effective 2026-08-01
A sub-processor is a third party we engage to process personal data on our behalf in the course of providing the Services. This page is the authoritative, current list referenced by our Privacy Policy and by the Data Processing Agreement (DPA) available to business customers. Each sub-processor is bound by a written agreement with confidentiality and data-protection obligations no less protective than our own.
| Sub-processor | Purpose | Data processed |
|---|---|---|
| Fly.io | Application hosting for all Ampbase services — including our self-operated deployments of SSOkenizer (OAuth proxy) and Tokenizer (secret sealing), open-source projects published by Fly.io — and the compute/storage for our self-managed telemetry-analytics cluster. | Account identity; all hosted data in transit; sealed OAuth secrets; reduced operational telemetry at rest (see the reduction note below). |
| Tigris Data | S3-compatible object storage. | Account, organization, and Customer Content at rest. |
| Google Cloud | Storage backend (Cloud Storage) and auto-unseal (Cloud KMS) for our secrets-management service (HashiCorp Vault). | Encrypted Vault data at rest, including sealed identity records — encrypted by us before storage; Google holds no keys and cannot read it. |
| Stripe | Subscription billing and payment processing. | Billing contact (name, email); payment card data collected directly by Stripe. See the note below. |
| Resend | Transactional email delivery. | Recipient email address and name (invitations, account and security notices). |
| Honeycomb | Observability for the Service itself. | Operational telemetry about your use of the Service (may include IP address and request metadata). |
Stripe acts as our processor for subscription billing carried out on our instructions, and as an independent controller for payment processing, fraud prevention, and its own legal and regulatory obligations. Stripe’s data-processing terms are incorporated into the Stripe Services Agreement, and Stripe maintains its own list of sub-processors. We do not receive or store full payment card numbers.
Operational telemetry from your agents is reduced on your own hosts — logs to structural templates, metrics to cardinality sketches, traces to aggregates — before it egresses. For those reduced streams we store structure and counts, not raw content. Four paths can carry un-reduced content, each under your control, and are disclosed in the DPA: optional, default-off scrubbed exemplars; the supervisor own-logs stream (raw agent stdout/stderr), which you control and can disable; a default-off transport-debug passthrough setting for telemetry agent types, documented as not for production use; and telemetry you direct at your ingest endpoint from cloud coding agents, which arrives without device-side redaction and is stored for 30 days.
Ampbase is based in the United States and these sub-processors operate globally. Where personal data originating in the European Economic Area, the United Kingdom, or Switzerland is transferred outside those regions, we and our sub-processors rely on Standard Contractual Clauses or another lawful transfer mechanism.
This page always reflects the current list; the Effective date above changes whenever the list does. Before we add or replace a sub-processor that processes Customer Content, we will notify the primary contact on each affected account by email at least 30 days in advance, giving you an opportunity to object as set out in the DPA. To receive these notifications, keep a current primary contact on your account, or email privacy@ampbase.io to subscribe.
Questions about our sub-processors or to raise an objection: privacy@ampbase.io.