Login
Start 14-day free trial

Sub-processors

Gleap uses the following sub-processors to provide its services. The contractually authoritative list is Annex 8.10 of our Data Processing Addendum.

Under the revised DPA, customers grant general written authorization for the listed sub-processors. Gleap provides at least 30 calendar days’ advance email notice before an additional or replacement sub-processor engaged directly by Gleap begins processing customer personal data. Customers may object during that period on reasonable data protection grounds. Publication of an updated list does not replace email notice.

For changes to further processors engaged by a sub-processor, Gleap promptly forwards the upstream notice by email, including the applicable notice and objection periods. These periods may be shorter than 30 days. Customers receive a reasonable opportunity to object. If the upstream timetable does not allow that opportunity before the change, or a timely objection remains unresolved when the change takes effect, Gleap suspends affected processing or provides an agreed alternative that avoids the objected-to provider, in accordance with clause 8.4.

Existing agreements that require individual written consent retain that requirement until validly amended.

The provider list was updated on September 6, 2026; regional hosting and endpoint disclosures were updated on September 20, 2026. Listing a provider does not establish that every provider is used for every customer or remove the DPA’s requirements for international-transfer safeguards. EU accounts use EU AI endpoints and US accounts use US AI endpoints. Regional endpoints for OpenAI and Grok describe model serving; other provider processing is governed by the applicable provider agreements and transfer safeguards.

Regional hosting and provider processing

Gleap supports EU and US data residency. Customer databases, uploaded files and backups stay in the region chosen at signup. A provider’s corporate address is not a guarantee of where it processes data. Regional hosting does not automatically localize email, monitoring, billing, integrations or AI processing. The provider-specific locations below apply to those services; see our data residency guide. Existing contractual authorization, notice and transfer-safeguard requirements continue to apply.

Infrastructure & hosting

  • DigitalOcean, LLC (USA) — regional hosting locations: Frankfurt, Germany (EU) and NYC3, New York (US), according to the selected region. Our main cloud provider: application servers, screenshot rendering, the production MongoDB database through DigitalOcean Managed Databases.
  • Cloudflare, Inc. (USA) — server locations: worldwide. File storage for screenshots and attachments uploaded through the Gleap widget and dashboard stays in the selected EU or US region. Global delivery and video-call infrastructure may involve processing outside that region.

Communication & delivery

  • Postmark (AC PM, LLC, USA) — server location: USA. Transactional email delivery.
  • Firebase (Google Ireland Limited, Ireland) — push notification delivery. This feature must be manually activated.

Billing

  • Stripe Payments Europe, Limited / Stripe Technology Europe, Limited (Ireland) — potential future payment provider for customer billing; not currently used. Any activation remains subject to the applicable contractual authorization and notification requirements.
  • Paddle.com Market Ltd. (UK) — payment provider for customer billing.

Monitoring

  • New Relic, Inc. (USA) — server location: EU (Frankfurt, Germany). Application performance monitoring and logging for Gleap’s infrastructure; telemetry may include request metadata.

Agent integrations

  • Sampark Inc. d/b/a Composio (USA) — integration platform powering custom-agent tool connections (e.g., third-party app actions and triggers configured by the customer).

AI providers (optional)

The following providers support optional AI features, including automated processing associated with enabled features. Administrators can disable individual AI features. AI availability is also subject to the account’s credit balance or legacy AI usage setting. Customers can choose from the models offered for configurable AI features, and Enterprise plans support bring-your-own-model arrangements. Selecting a model does not by itself guarantee a processing region; see the provider details below. Contact us for help configuring AI restrictions for your account. Under our DPA, Gleap shall not use customer personal data to train AI models or authorize providers to use it for that purpose.

  • OpenAI Ireland Ltd (Ireland) — Gleap uses EU regional endpoints for EU accounts and US regional endpoints for US accounts for OpenAI model serving.
  • Anthropic Ireland, Limited (Ireland) — processing may take place in the US or EU; EU-only processing is not guaranteed.
  • Google Ireland Limited (Ireland) — server locations: USA / EU. LLM processing through the Gemini API.
  • SpaceXAI LLC (xAI/Grok) (USA) — Gleap uses EU regional endpoints for EU accounts and US regional endpoints for US accounts for Grok model serving.
  • OpenRouter, Inc. (USA) — LLM routing gateway used to access additional AI models (e.g., DeepSeek, Qwen, Kimi, MiniMax, GLM). Requests are forwarded to downstream model-hosting providers and may be processed in the EU, United States, or China. Selecting a model does not guarantee the downstream hosting provider or processing region. Gleap does not currently offer full control over these routes.
  • Mistral AI SAS (France) — server location: EU. LLM processing for Mistral models.
  • Hangzhou DeepSeek Artificial Intelligence Basic Technology Research Co., Ltd. (China) — server location: China. Direct API used only as a fallback for DeepSeek models, which are primarily served via OpenRouter.

AI data processing

These services support Gleap’s AI features (knowledge base, Kai agents, and Kai Code) and process data only when those features are used:

  • MongoDB, Inc. (Voyage AI) (USA) — Voyage AI embedding and reranking through MongoDB Atlas for knowledge-base content, tickets, and messages used in AI search and retrieval. Atlas is used for AI inference, not production database hosting.

  • FoundryLabs, Inc. (E2B) (USA) — isolated cloud sandboxes in which Kai Code works on repositories the customer has connected.

  • SideGuide Technologies, Inc. (Firecrawl) (USA) — crawling of customer websites for knowledge-base ingestion and web retrieval for Kai agents.

  • TinyFish, Inc. (USA) — web search and page retrieval for Kai agents.

  • Endless Labs, Inc. (Datalab) (USA) — conversion of uploaded documents (PDFs, spreadsheets) to machine-readable text for AI processing.

  • Eleven Labs Inc. (ElevenLabs) (USA) — speech processing for the optional Kai Voice feature, including speech recognition and speech generation, through EU endpoints for EU accounts and US endpoints for US accounts. Other provider processing and onward transfers are governed by the applicable provider agreement and transfer safeguards.

Questions

For questions about this list, data locations, or to be notified of sub-processor changes, email privacy@gleap.io.