Legal
Sub-processors
- Last updated
- Version
- subprocessors-v2-2026-10-27
These are the service providers that process personal data for DeskGrade on our instructions. We tell customers before we add or replace one, so they can object, as our data processing agreement sets out.
About this document
This document states DeskGrade’s terms and commitments. It is not legal advice.
International transfers and safeguards
The locations below describe the service region where specified, not an exclusive processing boundary. Delivery, support, remote access, AI inference and onward suppliers can involve the USA and other countries outside the EEA. We do not impose or promise EU-only routing.
For transfers outside the EEA we require an applicable adequacy decision or appropriate safeguards, normally EU standard contractual clauses (SCCs, Decision (EU) 2021/914), with a proportionate transfer assessment and supplementary measures where needed. Reliance on the EU–US Data Privacy Framework requires current coverage of the exact recipient and service. Zero retention and no training are preferences, not transfer mechanisms.
The tables link the suppliers’ published transfer terms and identify limits to their scope. A published DPA is not evidence that every optional safeguard or regional setting applies to our account. Ask jan@pilotify.app for the applicable transfer basis, recipients, safeguards or a copy of the relevant safeguards. The customer–processor clauses in our own DPA (based on Decision (EU) 2021/915) do not themselves authorise third-country transfers.
Messaging and channel adapters
DeskGrade uses one general messaging and interaction layer with channel adapters. Channel providers that process personal data on our behalf will be listed here as sub-processors under the same notice and objection terms. Resend delivers our service emails. Independent processing by customer-selected services follows their own policies: Slack, WhatsApp, Google and Microsoft. The actual processing and contractual relationship determine the role, not the channel name.
Hosting, database and email
| Provider | What it does for DeskGrade | Data | Location | Published transfer terms |
|---|---|---|---|---|
| Vercel Inc. (USA) | Hosts the website and the app, runs server functions, background jobs, agent workspaces and the AI Gateway | All data passing through the service | Server functions in Stockholm, Sweden; global network for delivery | EU standard contractual clauses (SCCs) are included in the supplier’s published DPA for applicable transfers. DPA and transfer terms |
| Supabase (published DPA: Supabase Pte. Ltd., Singapore) | Database, sign-in and file storage | All stored data | Database and file storage in Stockholm, Sweden; supplier access and onward processing can occur elsewhere | EU standard contractual clauses (SCCs) are included in the supplier’s published DPA for applicable transfers. DPA and transfer terms |
| Plus Five Five, Inc. (Resend, USA) | Sends service emails such as invitations and sign-in links, and the website’s contact messages to us | Email addresses, names, email content | Processing under provider policy; no exclusive EU-region commitment. Resend | EU standard contractual clauses (SCCs) are included in the supplier’s published DPA for applicable transfers. DPA and transfer terms |
| Upstash Inc. (USA) | Limits repeated requests to protect the service | Short-lived abuse counters and keyed identifiers; relevant request-origin information | Processing under provider policy; no exclusive EU-region commitment. Upstash | EU standard contractual clauses (SCCs) are included in the supplier’s published DPA for applicable transfers. DPA and transfer terms |
| Functional Software Inc., Sentry (USA) | Error and performance monitoring | Technical error data; sending of personal details is switched off | Germany (EU) for the selected service region; support and onward processing can involve other countries | EU standard contractual clauses (SCCs) are included in the supplier’s published DPA for applicable transfers. DPA and transfer terms |
AI model providers
DeskGrade connects to OpenAI directly, Vercel AI Gateway, OpenRouter as a backup, and Anthropic using our own key through Vercel AI Gateway. We prefer providers with zero retention and no training on customer inputs; this is a routing preference, not a guarantee for every request. Provider terms and the configured route determine processing. Hosting in Stockholm, Sweden does not mean that AI inference, support or all onward processing stays in the EU. EU-only model routing is not currently guaranteed. See the current directly connected providers and each gateway’s published provider list. Pilotify does not train models on customer content.
| Provider | Purpose | Data | Location | Published transfer terms |
|---|---|---|---|---|
| OpenAI (EEA DPA: OpenAI Ireland Ltd.) | Direct model services, including live voice and image generation | Task text, audio and images | USA and other provider locations; inference region is not guaranteed EU-only | EU standard contractual clauses (SCCs) are included in the supplier’s published DPA for applicable transfers. DPA and transfer terms |
| Vercel Inc. — AI Gateway (USA) | Gateway; published provider list. Routing preference: zero retention and no training, not a guarantee. | Task inputs and outputs | Provider-dependent processing; not guaranteed EU-only | EU standard contractual clauses (SCCs) are included in the supplier’s published DPA for applicable transfers. DPA and transfer terms |
| OpenRouter Inc. (USA) | Backup gateway; published provider list. Routing preference: zero retention and no training, not a guarantee. | Task inputs and outputs | Provider-dependent processing; not guaranteed EU-only | The provider’s policy describes adequacy decisions or EU standard contractual clauses (SCCs), as applicable; onward model-provider terms depend on the route. Transfer policy |
| Anthropic (USA) | Model services using our own key (BYOK) through Vercel AI Gateway | Task inputs and outputs | USA and other provider locations; inference region is not guaranteed EU-only | EU standard contractual clauses (SCCs) are included in the supplier’s published DPA for applicable transfers. DPA and transfer terms |
Agent tools
| Provider | What it does for DeskGrade | Data | Location | Published transfer terms |
|---|---|---|---|---|
| Brave Software Inc. (USA) | Web search for agents | Search queries written by agents | USA | The provider excludes Search Query Data from its DPA; a transfer basis for personal data in queries is not established by that DPA. Avoid personal or confidential search terms. Provider notice |
| Jina AI (Elastic) | Reads public legal sources for legal research agents in customer workspaces | Addresses of public pages | Processing under provider policy; no exclusive EU-region commitment. Jina / Elastic | Elastic’s general policy describes adequacy and SCC safeguards for covered processing; it does not establish the terms for this specific Jina API route. Provider policy |
Services you choose to connect
Customer-selected services act under their own terms for independent processing and receive only what the connection needs. Where a provider processes on our behalf, it is a sub-processor and the register and notice terms apply.
- Google Calendar and Microsoft 365 calendar, for meeting sync.
- Slack, for talking to agents from Slack.
- GitHub, for coding agents.
- AI assistants such as ChatGPT or Claude, when you connect them to DeskGrade.
- Tenor, GIPHY and Unsplash, when you search for a GIF or a picture.
- YouTube, Vimeo and Loom, when a room shows a video from them.
Changes to this list
The customer gives general authorisation for sub-processors. Before adding or replacing a directly connected provider, Pilotify gives tenant administrators at least 30 days’ notice in-app and by email, with the effective date, change summary and information needed to object. Silence during that period means acceptance on the effective date; no fresh acceptance click is required. The customer may object through our legal contact during the notice period. If the objection cannot be resolved, it may terminate the affected service without penalty. An urgent security or availability replacement may begin immediately with prompt notice, subject to mandatory law and the same objection and exit rights. Published versions retain the change history; changing a gateway’s underlying provider list is tracked through that gateway’s linked list and our routing preference, not a new direct-connection row.
Contact
DeskGrade is provided by Pilotify (sole trader / toiminimi), Business ID 1820342-0, Harluntie 5, 02600 Espoo, Finland. Supplier, transfer and objection questions: jan@pilotify.app.