Data protection
Service Providers & Subprocessors
Effective September 30, 2026 · Last updated September 30, 2026
This page identifies service providers configured for Cedros-operated services and explains when they may process information. It supplements the Privacy Policy and Data Processing Addendum (DPA).
A subprocessor processes Customer Personal Data for Cedros when Cedros is acting as your processor. Some providers also act independently for purposes such as payment fraud prevention, legal compliance, or their own account administration. A service's presence here does not mean it receives every customer's data.
Infrastructure, delivery, and payments
| Provider | Function and information involved | Location information |
|---|---|---|
| DigitalOcean, LLC | Hosting for applicable managed deployments; Spaces media, files, and encrypted backup storage; media delivery | The configured Spaces region is sfo3, United States. The managed-deployment default is nyc3, United States. Actual customer hosting placement can differ. |
| Hetzner Online GmbH | Configured server infrastructure for applicable managed hosting; may hold website/application data, databases, and service logs | Hosting location depends on the assigned server. A provider's corporate location is not a promise of a customer's data location. Request the location for your deployment before relying on a regional requirement. |
| Cloudflare, Inc. | Public-site delivery/security and DNS services where used; request/network information; the public site's performance beacon | Distributed network. A visitor's location and the service configuration affect processing; no single-country restriction is represented. |
| Amazon Web Services | Amazon Simple Email Service (SES): sender/recipient information, message content, and delivery events | Configured SES region: us-east-2, United States. AWS's account-country contracting rules identify the applicable AWS entity. |
| Stripe | Enabled card-payment and billing integration: payer details, transaction data, subscriptions, and fraud-prevention information when used | Processing and legal entities depend on the applicable Stripe service and account. Stripe may act as both processor and independent controller. This listing does not promise availability of every checkout or paid feature. |
AI, voice, and search
These services receive information only when the selected feature or request uses them. Inputs may include prompts, files, relevant context, tool results, and request metadata. Model outputs may also be processed or retained for the applicable service purpose.
| Configured service | Provider identified in its published terms | Purpose |
|---|---|---|
| OpenAI | OpenAI OpCo, LLC under the standard terms for U.S. customers | AI model services |
| Anthropic | Anthropic, PBC under the standard terms for U.S. customers | AI model services |
| Google Gemini | Google LLC, subject to Gemini's additional terms | AI model services |
| xAI / Grok | SpaceXAI LLC, identified in the provider's current enterprise terms | AI model services |
| OpenRouter | OpenRouter, Inc. and the inference provider selected for the request | Routing and model inference |
| ElevenLabs | Eleven Labs Inc. under the standard non-EEA terms | Requested voice generation or processing |
| Exa | Exa Labs Inc. | Search queries and information included in those queries |
| Ahrefs | Ahrefs Pte. Ltd. | Domain, URL, backlink, and search-performance analysis |
The names above identify the providers' published standard terms; a negotiated order or account-specific agreement can identify a different contracting affiliate. They are not a representation that Cedros has separately signed every linked agreement.
No exclusive processing country, zero-retention setting, or blanket training exclusion by every third party is represented by this table. AI processing locations depend on the selected provider, product, and account arrangements. Contact Cedros for the locations and safeguards applicable to your proposed use before submitting data that requires a particular regional arrangement.
Routing, integrations, and customer choice
OpenRouter may send a request to a downstream inference provider. The router and the selected inference provider can both receive the relevant information. A model's brand alone does not identify every infrastructure entity handling a request. Provider selection and permitted changes remain subject to the DPA.
When you connect your own API key or external account, that provider relationship is governed by your own agreement with the provider. Cedros's responsibilities for its own handling of information still apply. Customer-selected integrations and independently installed extensions are not automatically Cedros subprocessors.
This page covers the configured services identified above. The specific providers, affiliates, downstream processors, and processing locations applicable to a Customer Site depend on its deployment and selected features. It is not a universal list for every customer-operated installation.
Customer information and change notices
Email [email protected] with your account or site identifier to request the current legal entities, service functions, countries, downstream providers, and transfer safeguards applicable to your Services. Do not include passwords, API keys, or sensitive datasets.
Under DPA Section 6, Cedros gives at least 30 days' prior written notice of a new or replacement subprocessor and provides the objection process described there. Notices go to the customer's designated privacy contact or account administrator. To designate or update that contact, email [email protected] from an authorized account contact. Updating this page does not replace a contractually required individual notice.
Restricted international transfers require an applicable lawful mechanism and safeguards. This list does not itself execute Standard Contractual Clauses, a UK transfer instrument, or any provider agreement.
Our privacy commitment
Cedros will never sell user information, including personal, aggregated, deidentified, or other information derived from users. Necessary provider processing to deliver the Services is limited by the applicable instructions, agreements, and law; it does not authorize sale. The DPA's restrictions on advertising, generalized model training, confidentiality, and subprocessors continue to apply.