SLOE Labs Inc. · Last updated: 3 August 2026
A sub-processor is any third party that may process customer data on our behalf in order to deliver the Service. This page lists all of them. We publish it because GDPR Art. 28(2) and POPIA s21 both require that customers can know who handles their data and object to a change — which is impossible if the list is incomplete or lags behind the code.
Notice of change. We will update this page before a new sub-processor begins processing customer data. Customers on a signed DPA may object under clause 5 of the Data Processing Addendum.
How to read this#
Every entry is cited to the place in the codebase that proves the dependency, so this list can be re-verified rather than trusted. If you believe an entry is incomplete or out of date, tell us at privacy@sloelabs.com and we will correct it.
Core infrastructure#
| Sub-processor | Purpose | Data it can see | Location | Evidence |
|---|---|---|---|---|
| Supabase, Inc. | Primary database, authentication, object storage | All customer content, account identifiers, credentials as hashes | United States | @supabase/supabase-js, VITE_SUPABASE_URL, SUPABASE_SERVICE_ROLE_KEY |
| Vercel Inc. | Hosting and CDN for the Studio (sloelabs.com) and its serverless functions | Request metadata; any content passing through /api/* in transit | Global edge; US-headquartered | root vercel.json; functions in /api/ |
| Hetzner Online GmbH | Compute for the tenant runtime (<slug>.sloelabs.com), via Coolify | All tenant runtime data in transit and in process memory | Germany (EU) | apps/tenant/Dockerfile; Coolify deploy |
| Redis | Rate limiting and ephemeral state | Request metadata, transient session state | Same infrastructure as the tenant runtime | REDIS_URL, ioredis, rate-limit-redis |
AI providers#
These process the prompts, documents, and context sent to the agent.
| Sub-processor | Purpose | Trains on our data? | Location | Evidence |
|---|---|---|---|---|
| Google LLC (Gemini API) | Primary LLM; also image and video generation | No — commercial (paid) tier, which bars training on submitted content and bars human review | US / global | @google/genai, GEMINI_API_KEY, api/llm-gateway.ts |
| Anthropic PBC (Claude API) | LLM for agent features | No — Anthropic does not train on API customer data by default | US | @anthropic-ai/sdk, ANTHROPIC_API_KEY |
| OpenAI, L.L.C. | Alternate LLM; image and video generation | No — OpenAI does not train on API data by default | US | openai, OPENAI_API_KEY, OPENAI_IMAGE_MODEL, OPENAI_VIDEO_MODEL |
| ElevenLabs Inc. | Voice synthesis for agent speech, where a customer uses that feature | Governed by the provider's own terms | US | ELEVENLABS_API_KEY, ELEVENLABS_VOICE_ID* |
| Kling | Video generation, where a customer uses that feature | Governed by the provider's own terms | China | KLING_ACCESS_KEY, KLING_SECRET_KEY, KLING_API_BASE |
Integrations and delivery#
| Sub-processor | Purpose | Data it can see | Location | Evidence |
|---|---|---|---|---|
| Composio | Connector infrastructure — brokers the customer's connections to Gmail, Slack, LinkedIn, Notion and others, and executes tool calls against them | High sensitivity: holds or brokers OAuth grants to the customer's own third-party accounts, and sees the payloads of actions taken through them | US | @composio/core, COMPOSIO_API_KEY, apps/tenant/server/connectors/ |
| Google LLC (OAuth / Workspace APIs) | Direct Gmail and Sheets connectors | Only the scopes the customer grants — gmail.send (send only, no inbox read) and spreadsheets.readonly on explicitly connected sheets | US / global | GOOGLE_OAUTH_CLIENT_ID, GOOGLE_OAUTH_CLIENT_SECRET |
| Resend | Transactional email delivery — sign-in links, notifications, agent-sent mail | Recipient addresses and message content | US | RESEND_API_KEY, apps/tenant/server/notify/ |
| Stripe, Inc. | Payment processing for paid plans | Billing contact and payment details. We never receive or store full card numbers. | US | stripe, STRIPE_SECRET_KEY, api/create-checkout.ts |
| Functional Software, Inc. (Sentry) | Error monitoring and performance tracing | Stack traces and request context, which can incidentally contain personal data | US | @sentry/node, @sentry/react, SENTRY_DSN |
Affiliates#
| Entity | Purpose | Notes | |
|---|---|---|---|
| SLOE OS Substrate (SLOE Labs-operated) | Shared internal services called by the tenant runtime | Self-operated on our own infrastructure rather than a third party, but it is a real data flow out of the tenant process and is disclosed for that reason | SUBSTRATE_BASE_URL, SUBSTRATE_API_KEY |
Cross-border transfers#
Customer data is processed outside the customer's own country. Specifically:
- EU / UK customers — data reaches US-based providers (Supabase, the AI providers, Stripe, Resend, Sentry). Transfers rely on the EU Standard Contractual Clauses and the UK Addendum, incorporated by reference in Annex C of the DPA. Compute for the tenant runtime is in Germany.
- South African customers — transfers out of South Africa are permitted under POPIA s72 on the basis of the contractual protections in the DPA, which bind each recipient to a standard of protection substantially similar to POPIA's conditions for lawful processing. The customer's consent to this transfer is recorded in the DPA rather than assumed.
- Kling (China) is used only where a customer uses video generation. It is the one recipient not covered by an adequacy decision or standard clauses; customers who do not use that feature are unaffected.
Change log#
| Date | Change |
|---|---|
| 3 August 2026 | Initial published list. Supersedes the partial list in the previous privacy.html, which named 6 of these and omitted Google, OpenAI, Composio, Sentry, ElevenLabs, Kling, and Redis. |