Sub-processors
Last updated: 11 July 2026.
truelo uses a small number of third-party services to run the product. Each is a data processor acting on our instructions; we share only what a given service needs to do its job. Providers that require it (for example AI providers processing data outside the EEA) are covered by an appropriate transfer safeguard such as the EU Standard Contractual Clauses.
| Provider | Purpose | Data processed | Region |
|---|---|---|---|
| Vercel | Application hosting (serverless compute & CDN) | Requests in transit; no application data stored at rest by Vercel | US / global edge |
| Supabase | Database & storage of workspace data | All stored app data (identities, activity, settings; integration secrets encrypted at rest) | EU (eu-west-1) |
| OpenAI | AI work summaries & ratings (when configured) | Commit messages and notes sent to generate summaries — not used to train models under the API terms | US |
| Anthropic | AI work summaries & ratings (alternative provider) | Commit messages and notes sent to generate summaries — not used to train models under the API terms | US |
| Slack | Delivery of the product (slash commands, DMs, digests) | Slack user IDs, names, emails; message content the app posts | US |
| Stripe | Subscription billing (when enabled) | Billing contact + subscription metadata; card data is handled by Stripe, never by us | US / EU |
| Resend | Transactional email (when enabled) | Recipient email + message content (e.g. trial / payment notices) | US |
Connected sources are not sub-processors. When your organization connects GitHub, Jira or Slack, those are your systems that truelo reads from on your instruction — your organization remains their data controller. They are listed for transparency in our Privacy Policy, not as our sub-processors. (Slack appears above because we also process Slack identities and post messages through it to deliver the product.)
This list reflects our current sub-processors and may be updated as the product evolves; material changes will be posted here. A Data Processing Agreement (DPA) is available on request.
See also our Privacy Policy.