← Codas Labs
Effective 22 October 2026
Sub-processors
Last updated 22 October 2026.
These are the third-party service providers ("sub-processors") that may process personal data our customers put into each Codas Labs product. Each is bound by a written agreement requiring it to protect that data and use it only to provide its service to us. We remain responsible for them under our Data Processing Addendum.
Customer support conversations for every product are handled in Tore, our own support product, so the Tore list below also applies to support conversations.
Products: SurveyTale · LeadTale · MeshTale · Tore · TokenUsage · TribeTale
SurveyTale
| Sub-processor | What they do for us | Personal data involved | Location |
|---|---|---|---|
| Amazon Web Services, Inc. | Hosting, database, cache, file storage | All customer and respondent data | USA (us-east-1) |
| Stripe, Inc. / Stripe Payments Europe | Subscription billing and checkout | Account owner name, email, billing details | USA |
| Hetzner Online GmbH | Website and email server (run by Codas Labs) | Names, email addresses, message content | USA (Oregon) |
| Functional Software, Inc. | Error monitoring | Technical logs that may include user identifiers | USA |
| PostHog Inc. | Product analytics / session replay | User id, email, name, in-app activity | EU or USA |
| Microsoft Corp. | Session replay | In-app activity, device data | USA |
| Google LLC / Google Ireland | Web analytics | Device data, pages visited | USA |
| Chatwoot Inc. | In-app support chat | Name, email, chat content | Not yet confirmed |
| HighLevel Inc. | Customer relationship management and marketing email | Name, email | USA |
| Cloudflare / Google | Bot protection on forms | IP address, device signals | Global |
LeadTale
| Sub-processor | What they do for us | Personal data involved | Location |
|---|---|---|---|
| Google LLC | Hosting, file storage, cache | All customer data | USA (us-east4) |
| MongoDB, Inc. | Primary database and search | All customer data and the contact database | USA |
| Amazon Web Services, Inc. | File storage (legacy, confirm) | Uploaded files | USA |
| Elasticsearch B.V. | Search (confirm still used) | Contact and search data | Not yet confirmed |
| Vercel Inc. | Marketing site and opt-out form | Visitor data, opt-out requests | USA |
| Cloudflare, Inc. | DNS and network security | IP addresses, request metadata | Global |
| Stripe, Inc. / Stripe Payments Europe | Subscription billing and card payments | Account owner name, email, billing and payment details | USA |
| Resend, Inc. | Transactional email | Names, email addresses, message content | USA |
| HighLevel Inc. | Marketing CRM and booking | Name, email, phone of customers and prospects | USA |
| Functional Software, Inc. | Error monitoring | Technical logs that may include user identifiers | USA |
| OpenAI, L.L.C. | AI search and embeddings | Search queries; may include contact data | USA |
| NumLook | Phone number validation | Phone numbers | USA |
| Unwired Labs | Address geocoding | Addresses / locations | USA |
| Microsoft Corp. | Session replay in the app (consent-gated) | In-app activity, device data | USA |
| Logo.dev | Company logos shown in the app | Visitor IP address | USA |
MeshTale
| Sub-processor | What they do for us | Personal data involved | Location |
|---|---|---|---|
| Fly.io, Inc. | Application hosting | All customer data in processing | USA (Virginia) |
| Vercel Inc. | Web app hosting | Visitor and session data | USA (Virginia) |
| Neon | Primary database | All customer data | USA (us-east-1) |
| Qdrant Solutions GmbH | Vector search index | Embeddings of customer content | USA (us-east-1) |
| Cloudflare, Inc. | File storage (R2) | Uploaded customer files | Global |
| Tigris Data, Inc. | File storage | Uploaded customer files | USA |
| OpenAI, L.L.C. | AI language models and embeddings | Customer content sent in prompts | USA |
| Anthropic PBC | AI language models | Customer content sent in prompts | USA |
| Google LLC | AI language models | Customer content sent in prompts | USA |
| OpenRouter, Inc. | AI model routing | Customer content sent in prompts | USA + model hosts |
| Resend, Inc. | Transactional email | Names, email addresses, message content | USA |
| Stripe, Inc. / Stripe Payments Europe | Subscription billing | Account owner name, email, billing details | USA |
| Functional Software, Inc. | Error monitoring | Technical logs that may include user identifiers | USA |
| Microsoft Corp. | Session replay (consent-gated) | In-app activity, device data | USA |
| Automattic Inc. | Profile pictures | Hashed email address | USA |
Tore
| Sub-processor | What they do for us | Personal data involved | Location |
|---|---|---|---|
| Fly.io, Inc. | Application hosting | All customer data in processing | USA (Virginia) |
| Vercel Inc. | Web app hosting | Visitor and session data | USA |
| Neon | Primary database | All customer and end-user data | USA |
| Upstash, Inc. | Job queues | Job data that may include message content | USA |
| Amazon Web Services, Inc. | Sending and receiving email | End-user emails, names, message content | USA (us-east-1) |
| Amazon Web Services, Inc. | File storage (emails, attachments, knowledge base) | Message content and attachments | USA |
| OpenAI, L.L.C. | AI language models | Customer and end-user content in prompts | USA |
| Anthropic PBC | AI language models | Customer and end-user content in prompts | USA |
| Google LLC | AI language models | Customer and end-user content in prompts | USA |
| Typesafe | Reply classification (feature-flagged) | Message content | Not yet confirmed |
| Stripe, Inc. / Stripe Payments Europe | Subscription billing | Account owner name, email, billing details | USA |
| Cloudflare / Google | Bot protection on the chat widget | IP address, device signals | Global |
TokenUsage
| Sub-processor | What they do for us | Personal data involved | Location |
|---|---|---|---|
| Hetzner Online GmbH | Hosting and database | All customer data | Germany (Nuremberg) |
| Cloudflare, Inc. | Network, file storage, encrypted backups, cookieless analytics | All customer data (encrypted backups), IP addresses | Global |
| Resend, Inc. | Transactional email | Names, email addresses, message content | USA |
| HighLevel Inc. | Customer relationship management | Name, email, marketing preference | USA |
| Typesafe | AI suggestions (matching repo names to projects) | Repository and project names | Not yet confirmed |
| Google LLC / Google Ireland | Web analytics (consent-gated in EU) | Device data, pages visited | USA |
| Stripe, Inc. / Stripe Payments Europe | Subscription billing | Account owner name, email, billing details | USA |
TribeTale
| Sub-processor | What they do for us | Personal data involved | Location |
|---|---|---|---|
| Amazon Web Services, Inc. | Hosting and secrets | All customer and member data | USA |
| Stripe, Inc. / Stripe Payments Europe | Member payments | Payment card data, name, email | USA / Ireland |
| Sinch Mailgun | Newsletter sending | Member names, emails, newsletter engagement | USA or EU |
| Hetzner Online GmbH | Email server (run by Codas Labs) | Names, email addresses, message content | USA (Oregon) |
| Functional Software, Inc. | Error monitoring | Technical logs that may include user identifiers | USA |
| Google LLC | Mobile app crash reports | Device data, user id | USA |
| 650 Industries, Inc. | Mobile app updates | Device metadata | USA |
| Automattic Inc. | Member profile pictures | Hashed email address | USA |
Getting notified of changes
We update this page at least 30 days before a new sub-processor starts processing customer personal data. To be emailed when it changes, send "Subscribe — sub-processors" (and the product name) to privacy@codaslabs.com from your account email. You may object to a new sub-processor as described in section 4 of the Data Processing Addendum.
Questions
privacy@codaslabs.com · Codas Labs, LLC, 1300 South Blvd, Suite 38821, Charlotte, NC 28203, USA.
© 2026 Codas Labs, LLC · Privacy · Terms · DPA · Sub-processors · Do not sell or share my personal information
Back to codas labs · Codas Media