This page lists the third parties ("Sub-processors") that may process Customer Personal Data on behalf of Kosuke, Inc. when providing the Kosuke platform, under the Data Processing Agreement. We provide at least 30 days advance notice before engaging a new Sub-processor, giving Customers the opportunity to object as set forth in the DPA.
Current Sub-processors
| Sub-processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| GitHub, Inc. (Microsoft) | Repository connection and developer workflow. Processes repository metadata, webhook events, and Customer-authorized repository access. | United States | SCC + supplementary measures |
| E2B (FoundryLabs, Inc.) | Ephemeral cloud sandboxes that build and run Customer code. Processes repository contents and any Personal Data present in them. | United States | SCC + supplementary measures |
| DigitalOcean, LLC | Object storage for attachments and sandbox and preview infrastructure. | United States / European Union | SCC where transferred outside the EEA |
| Cloudflare, Inc. | Authoritative DNS for kosuke.ai and all subdomains, and CDN and edge delivery for the marketing site. Application traffic does not transit the Cloudflare edge. | Global edge network | SCC + supplementary measures |
| Anthropic, PBC | LLM inference for AI features (Claude). Prompts, repository context, and attachments sent for inference may include Personal Data. | United States | SCC + supplementary measures (zero data retention where contractually available) |
| Amazon Web Services, Inc. (Bedrock) | LLM inference for AI features where configured. Same categories of data as above. | United States / European Union | SCC + supplementary measures |
| Google LLC (Gemini) | LLM inference for AI features where configured. Same categories of data as above. | United States | SCC + supplementary measures |
| Vercel Inc. (AI Gateway) | Routing LLM inference requests to model providers. Prompts, repository context, and attachments sent for inference may include Personal Data. | United States | SCC + supplementary measures |
| TypeSafe AI, Inc. (Jev) | Bounded classification for AI features, including chat relevance and session-health signals. Prompts, repository context, and attachments sent for inference may include Personal Data. | United States | SCC + supplementary measures (no training on customer requests or responses; zero data retention available to enterprise customers) |
| Amazon Web Services, Inc. (SES) | Transactional and newsletter email delivery, including platform authentication email such as sign-in codes and invitations. Processes recipient email addresses and delivery records. | European Union (eu-central-1) | Processed in the EEA |
| Functional Software, Inc. (Sentry) | Error monitoring and diagnostics. May incidentally process user identifiers present in error context. | United States | SCC + supplementary measures |
Notifications and objections
We will notify Customers of intended changes to this list (additions or replacements) at least 30 days in advance, in accordance with Section 4 of the DPA and Clause 9, Option 2 of the SCC.
To subscribe to Sub-processor change notifications, or to raise a reasonable objection to a planned change, contact security@kosuke.ai.
Planned changes
No Sub-processor changes are planned at this time.
What's not on this list, and why
The following third parties are not Sub-processors under the DPA:
- Analytics, marketing, and consent providers (Cookiebot, Reddit, X, Meta): these process visitor data on the public marketing site, not Customer Personal Data from connected workspaces. The public site no longer runs analytics of its own. These providers are described in our Privacy Policy and Cookies Policy.
- Internal operations tooling (Slack, BetterStack): these receive Kosuke-internal operational alerts and telemetry, not Customer workspace content.
- Databases and queues: Postgres and Redis run on Kosuke-controlled infrastructure rather than a managed third-party service, so no separate database Sub-processor is engaged.
- Customer-configured AI providers: where a Customer supplies its own provider credentials, that provider processes data under the Customer's own agreement with it, and the Customer is responsible for that relationship.
Contact
For questions about Sub-processors or transfer mechanisms, contact security@kosuke.ai.