Subprocessors

Effective June 3, 2026

Draft template. This document is a starting point pending review by the operator’s legal counsel. It is provided for convenience and is not legal advice.

The third-party services OS x relies on to operate.

About this list

We engage the vendors below to help operate OS x. Each is bound by contract to confidentiality and security obligations appropriate to the data it processes. We update this list as our vendors change. A subprocessor only receives the data needed for its function.

Current subprocessors

Subprocessor	Purpose	Data categories	Region
Anthropic	AI model inference for assistant features	AI prompts and the workspace context needed to answer them	United States
Supabase	Database, file storage, and authentication	Account data and workspace content	United States
Resend	Transactional email delivery	Recipient email, message content	United States
Stripe	Subscription billing and payments	Billing contact and payment metadata	United States
Twilio	SMS one-time codes for document signing	Recipient phone number, verification code	United States
LiveKit	Real-time video for meeting rooms	Session connection data, audio/video streams	United States
Vercel	Application hosting and delivery	Request metadata and logs	United States / global edge
ClamAV (self-hosted)	Malware scanning of uploaded files	Uploaded file contents (transient)	Operator-controlled

Vendor policies

For the AI subprocessor, see Anthropic’s Usage Policy (https://www.anthropic.com/legal/aup) and Privacy Policy (https://www.anthropic.com/legal/privacy). Links to other vendors’ terms are available on request.

Changes

We will update this page when we add or remove a subprocessor. Where your agreement requires advance notice of subprocessor changes, we will provide it as agreed.