super.AI Sub-Processors

AI model makers are not sub-processors. We use models from Anthropic, OpenAI and others, but we reach them as deployments inside Google Cloud (Vertex AI) and Microsoft Azure, so the parties that receive and process your content are Google and Microsoft, which are listed above. Fireworks AI is the one model provider we use directly, and it is listed in its own right. We name the model makers here because it is the question customers actually ask, not because they process your data for us.

Vendors deliberately not on this list, and why. Loom and LinkedIn process employee and candidate data, not customer data. GitHub holds our source code; no customer personal data reaches it. Our compliance tooling holds corporate evidence, not customer content. Listing any of them would assert processing that does not happen. Our blog CMS holds marketing content only. All of them remain in our internal vendor inventory, which is broader than this page by design.

Self-hosted software is not a sub-processor. Our error monitoring (Grafana Faro) reports to our own collector, and our model proxy (LiteLLM) runs inside our own infrastructure. No third party receives data through either, so neither appears above. If we ever route model traffic directly to a model maker instead of through a cloud host, that vendor becomes a sub-processor and this page is updated before the change ships.

Transfers out of the EEA.The transfer column names the instrument each vendor relies on, taken from that vendor's own published data processing terms. Where a vendor relies on the EU-U.S. Data Privacy Framework we say so and name the fallback its terms specify. "Confirmation pending" means we have not yet confirmed which instrument applies to the specific legal entity we contract with. It is not a statement that no instrument is in place, and we would rather say so than name one we have not checked. A copy of the transfer safeguards for any vendor above is available on request from security@super.ai.

Advertising measurement is different. For website analytics Google acts as our processor. For advertising measurement we and Google decide the purpose together, so we are joint controllers of that processing, and what is uploaded includes a one-way hash of the email address of a user who signed up. Nothing is uploaded unless you consented to marketing cookies, and our Privacy Policy explains how to stop it.

Where a sub-processor processes content you submit, it does so on our instructions to operate the service. Our own use of self-service account content is described in our Privacy Policy.