Start freeBook a Demo
Trust & compliance

Subprocessors

Every company that processes data on behalf of Spinrun, what each one does, and how we tell you when the list changes.

Last updated v2026-10-05

Running Spinrun means other companies touch your data. This page names all of them. It is the list the Privacy Policy summarises and the list the Data Processing Agreement incorporates by reference, so it is the one to check.

Each is bound by a data-processing agreement no weaker than the one we give you, and each is engaged only for what is listed against its name.

Contents

  1. 1.Infrastructure

    These run the Service itself. Data reaches them whenever you use Spinrun at all.

    Railway
    Runs the database (account data, workspace membership, connection records, activity logs, conversations and Brain embeddings) and its backups, the gateway that carries tool calls to connected applications, and the agents runtime with its short-lived cache of in-flight turns: each agent turn, the model and tool calls it makes, and scheduled and background work. All in Railway's EU West region (Amsterdam, the Netherlands).
    Vercel
    Application hosting and delivery. Every request to the site passes through it. The application's functions run in the EU (region fra1); they reach the database over an encrypted connection.
    Cloudflare R2
    Object storage: for agent-authored artifacts and for tool results too large to return inline; for the Apps you build, their source and built releases; and, from the release that turns uploads on, for files people upload to Apps. Every bucket is private and no pre-signed URL is ever issued. The bucket for files uploaded to Apps is in the EU jurisdiction; the others are not region-pinned.
    Cloudflare Workers
    Builds and runs the Apps you build (builds in Cloudflare's containers, not region-pinned): each App's code, and its database and log, which are held in Durable Objects in the EU jurisdiction; the Apps' addresses, names and descriptions are kept across Cloudflare's network. The runtime's diagnostic logs, which can include what an App's code prints and each request's address and headers (an uploaded file's name among them), are kept by Cloudflare and are not region-pinned. Separately, receives email sent to agents' mailboxes and passes each accepted message to the agents runtime, storing nothing. Workers execute on Cloudflare's global network, so the code itself is not region-pinned.

  2. 2.Search and generation

    Platform-funded tools an agent may call. Each receives only what the agent sends it — a search query, a page to read, a prompt — and only when a tool from that provider is actually used.

    Groq
    Text generation on Groq-hosted models, reached directly rather than through the AI Gateway. It sees the prompt and returns the completion. United States.
    Exa
    Web search and page reading. It sees the query and the URLs an agent asks it to read. United States.
    Tavily
    Web search and page reading. It sees the query and the URLs an agent asks it to read. United States.
    SerpAPI
    Google search results. It sees the query. United States.

  3. 3.Models and execution

    These receive content, rather than only carrying it. If what your agents handle is sensitive, this is the section to read twice.

    Vercel AI Gateway
    Routes model calls by default. A workspace that brings its own Anthropic, OpenAI or Google API key sends its model calls directly to that provider instead, under the customer's own agreement with it, and not through the gateway, except the premium generation tools (Gemini text, image and video generation), which run through Spinrun on Spinrun's credits. Spinrun can also route a provider's models directly on its own key; that route is not used in production today.
    Google
    The Gemini models behind the playground, reached through the gateway above, and Brain embeddings, which always use Spinrun's Google model, including for a workspace that brings its own keys. Separately, Google sign-in, if you use it.
    E2B
    Runs agent-authored code, on plans where sandboxes are enabled. Code and the data it is given execute in a short-lived, isolated virtual machine on Google Cloud, shut down when the run ends; only the run's work folder is kept, for seven days, in our own storage. E2B's default region is in the United States; its EU cluster (Belgium) will be named here once it runs our sandboxes.

  4. 4.Connections and communication

    Composio
    The toolkit catalogue and the connection infrastructure behind many integrations. It holds the authorisation for a connected application and executes the calls your agents make through it.
    Cloudflare
    Transactional email — workspace invitations and administrative notices, sent through Cloudflare Email Sending. It sees the recipient's address and the message.

  5. 5.Analytics

    One provider, used for two things that are worth keeping apart.

    PostHog (EU)
    On the marketing site: pages opened, clicks, and masked session replays — only for visitors who accepted the cookie banner, and nothing at all for those who did not. Inside the product: a short list of server-side events against an account identifier, with the workspace's identifier beside it — a workspace being created, an app being connected, onboarding being finished, an AI client being authorized, a chat being started, which tools are called (a sample of calls: the tool and app, whether it worked and how long it took), an agent's run finishing, an approval being decided, and credits running out — with no messages, prompts or answers, no tool inputs or results, no file names and no customer data. Hosted on PostHog's European instance, so none of it leaves the EEA.
    Cookie PolicyWhere each system runs

  6. 6.Error reporting

    When something fails, a technical report of the failure, so that we can fix it.

    Sentry (EU)
    Error reports from the web application (its server and the browser) and from the agents runtime: the type of error, its message with anything it quotes or puts in brackets removed except a property name or a short error code, the stack trace, the page's route with identifiers and query strings removed, the release, and for a browser error the user-agent header of the request that carried it; a report from the agents runtime also carries the internal identifiers of the run, chat, agent and workspace involved. Built to leave out request bodies, cookies, email addresses, IP addresses and what your agents read or write, and with no session recording. Browser reports pass through our own server, and the code that sends them stores nothing on the visitor's device and reads no information stored on it. Operated by Functional Software, Inc.; held in Sentry's EU data region, Frankfurt, Germany.

  7. 7.The applications you connect

    The third-party applications you authorise — a CRM, a mailbox, a spreadsheet — are not our subprocessors. You have your own relationship with each of them under their own terms, and we exchange data with them because you told us to. What they do with it is governed by their agreement with you, not ours.

  8. 8.How the list changes

    We give 14 days' notice, by email to workspace owners, before a new subprocessor begins processing your data. If you object on reasonable data-protection grounds and we cannot resolve it, you may terminate the affected part of the Service.

    We remain responsible for what a subprocessor does with your data as if we had done it ourselves.

    Data Processing AgreementPrivacy Policy

  9. 9.Change log

    2026-08-22
    First published. Adds Google, the Vercel AI Gateway and Vercel Sandbox, which the Privacy Policy had not previously named.
    2026-08-22
    Adds PostHog (EU) for marketing-site analytics and server-side product events. Marketing analytics is consent-gated and is not customer data; the product events are, which is why PostHog is listed here rather than only in the Cookie Policy.
    2026-08-28
    Names where each infrastructure provider runs, where that is confirmed: Supabase in Frankfurt, PostHog in the EU, Vercel functions pinned to Frankfurt (fra1), Vercel Sandbox not region-pinned. Replaces Resend with Cloudflare for transactional email, which is what the code has sent through since the switch.
    2026-09-10
    Agent-authored code now runs in a container on Cloudflare rather than in Vercel Sandbox, which has been removed from the product entirely. No new provider: Cloudflare was already named here for object storage, the agents runtime and transactional email. Neither location was region-pinned before or after.
    2026-08-28
    Adds Cloudflare Workers, which has run the agents runtime since it launched, and the search and generation providers behind the platform-funded tools: Groq, Exa, Tavily and SerpAPI. All four were reachable from the code before they were named here; this entry corrects that.
    2026-09-25
    The agents runtime moved from Cloudflare Workers to Railway, in its EU West region (Amsterdam). Agent-authored code moved from Cloudflare Containers to E2B. Cloudflare Workers now only receives email sent to agents' mailboxes; Cloudflare stays for object storage, email sending and DNS.
    2026-10-03
    Adds Sentry (Functional Software, Inc.), in its EU data region in Frankfurt, for error reports. The agents runtime was built to report its errors to Sentry before Sentry was named here; this entry corrects that, and adds the web application's server and browser errors. Reports are built to leave out content and IP addresses, and record no session.
    Planned
    Railway, also to host the background worker that ingests Brain documents. Not yet in use for that; it will be announced here and by email before it processes anything.
    2026-10-01
    Railway also holds the database and its backups (account data, workspace membership, connection records, activity logs, conversations and Brain embeddings) and runs the gateway that carries agents' tool calls to connected applications, in its EU West region (Amsterdam, the Netherlands), in place of Supabase. Sign-in moved into our own application code; no new provider.
    2026-10-03
    Supabase deleted its read-only copy of the database and left this list.
    Planned
    Google Cloud Vertex AI, to serve Google's Gemini models under Spinrun's own agreement, in the EU (video generation in the US; Gemini 3 Pro Image, which an agent may choose for an image, on Google's global endpoint, not pinned to a region). Announced by email at least 14 days before it takes effect.
    2026-10-05
    Names Cloudflare for the Apps you build, which it has run since Apps launched: each App's code, database and log (the database and log in Durable Objects in the EU jurisdiction), and its source and built releases in object storage that is not region-pinned. Adds a new kind of data for Cloudflare to store: files people upload to Apps, in an R2 bucket in the EU jurisdiction, from the release that turns uploads on and at least 14 days after we email workspace owners about it. The runtime's diagnostic logs, which can include what an App's code prints and each request's address and headers (an uploaded file's name among them), are kept by Cloudflare and are not region-pinned.

  10. 10.Contact

    Questions about this list, or a request for the transfer safeguards behind a particular provider, go to legal@spinrun.ai.

Before anything loads

We would like to switch on analytics, so we can see which pages are worth keeping. Nothing has loaded yet and nothing will until you choose. The cookies that keep you signed in and remember your language are not part of this.

Read the Cookie Policy