Subprocessors
Last updated October 15, 2026
Know exactly where your data is and how it’s used. These are the third parties Neotask uses or plans to use for the stated purposes. Production use remains subject to the applicable contractual, consent, and transfer safeguards described in our compliance records.
You’re in control. Vendors marked Connected by you receive your data only when you choose to connect that integration — for example, we never send anything to Slack, Telegram, or your Google account unless you link them yourself. Vendors marked Consent controlled receive advertising measurement data only after a separate visitor choice and while Neotask has enabled that service.
Infrastructure & Hosting
| Name | Purpose | Location | Website |
|---|
| Amazon Web Services (AWS) | Web hosting, the database that stores your account records and product data, object storage (S3), managed PostgreSQL databases (RDS), and service recovery emails through SES when enabled | United States | aws.amazon.com |
| Cloudflare | CDN, DNS, and security / DDoS protection for our websites | United States | cloudflare.com |
| Heroku (Salesforce) | Application hosting + Redis caching and background job queue for the Neotask website and API | United States | heroku.com |
| Supabase | Object storage for files, generated assets, images, and website builds | United States | supabase.com |
| VercelConnected by you | Optional deployment and stable-link hosting of websites and presentation decks you explicitly publish | United States | vercel.com |
AI & Language Models
| Name | Purpose | Location | Website |
|---|
| Anthropic | Language models that power AI features | United States | anthropic.com |
| OpenAI | Language models, transcription, and image generation for AI features | United States | openai.com |
| Google (Gemini / Generative AI) | Language models and image generation for AI features | United States | ai.google.dev |
| xAI (Grok)Connected by you | First-party Grok language models, used when you select a Grok model (requests go directly to xAI under our platform key, or your own key if you bring one) | United States | x.ai |
| OpenRouter | Primary route for hosted (Neotask credits) AI requests to OpenAI, Anthropic and Google models, including image generation; forwards each request to that model provider. Not used for bring-your-own-key requests or the HIPAA tier (transfer mechanism: Standard Contractual Clauses under the OpenRouter DPA). Neotask's own Claude requests (for example onboarding brainstorm, company profile and website analysis, payment dispute responses, sales and support phone-call answers and summaries, and tool action classification) pass through it to Anthropic only, with no fallback to other providers and no training on the data. Neotask's own GPT image requests (social media images) pass through it to OpenAI only, with no fallback to other providers | United States | openrouter.ai |
| AWS Bedrock (Amazon Web Services)Connected by you | BAA-covered, US-region hosted language models — the only AI provider that receives data on the HIPAA tier (transfer mechanism: US / EU-US Data Privacy Framework) | United States | aws.amazon.com |
| TypeSafe AI | Fast typed classification and ranking decisions that help AI agents triage email, route chat messages, choose tools, and prioritize tasks; disabled in HIPAA mode | United States | typesafe.ai |
| Other configurable model providersConnected by you | Additional language-model providers (e.g. MiniMax, Moonshot, Qwen, Together AI, Nvidia, Hugging Face), used only when you explicitly configure them | Varies by provider (some, e.g. MiniMax / Moonshot / Qwen, process in China) | openrouter.ai |
Voice & Speech
| Name | Purpose | Location | Website |
|---|
| Deepgram | Speech-to-text for the voice control feature | United States | deepgram.com |
| ElevenLabs | Text-to-speech voice for AI calls and voice features; transcription of media you edit, and generated voiceover, music and sound effects for videos | United States / EU | elevenlabs.io |
Payments & Billing
| Name | Purpose | Location | Website |
|---|
| Stripe | Subscriptions, invoicing, payments, and chargeback/dispute handling. For companies you build through Neotask, Stripe Connect also powers "Neotask Payments" — your customers pay, Stripe handles identity verification and payouts to your own bank, and Neotask keeps a 15% platform fee. Where your AI agent spends on your behalf, Stripe also issues and authorizes the virtual payment cards that back that spend | United States | stripe.com |
Communication & Channels
| Name | Purpose | Location | Website |
|---|
| SlackConnected by you | Slack channel relay you connect | United States | slack.com |
| DiscordConnected by you | Discord channel relay you connect | United States | discord.com |
| TelegramConnected by you | Telegram channel relay you connect | Global | telegram.org |
| Microsoft Teams / Bot FrameworkConnected by you | Microsoft Teams channel relay you connect, including Bot Framework message delivery and Microsoft Graph/Entra directory/install flows | US / Global | microsoft.com |
| Google ChatConnected by you | Google Chat channel relay you connect | United States | workspace.google.com |
| X (Twitter)Connected by you | Social posting you connect | United States | x.com |
| TwilioConnected by you | SMS and voice telephony for calls and scheduling links | United States | twilio.com |
| AgentMail | Per-company email inboxes (send/receive) for AI agents | United States | agentmail.to |
Identity & Integrations
| Name | Purpose | Location | Website |
|---|
| Google WorkspaceConnected by you | Sign-in and the Google integrations you connect (Gmail, Calendar, Drive, Docs, Sheets) plus transactional email | United States | workspace.google.com |
| Apple (Sign in with Apple)Connected by you | Apple sign-in | United States | apple.com |
| GitHubConnected by you | Code and website repository hosting for projects you create | United States | github.com |
Push & Notifications
| Name | Purpose | Location | Website |
|---|
| Apple Push Notification service (APNs)Connected by you | iOS push notification delivery | United States | developer.apple.com |
| Expo PushConnected by you | Mobile push delivery for approval notifications (if you use the mobile app) | United States | expo.dev |
Analytics & Monitoring
| Name | Purpose | Location | Website |
|---|
| Google Analytics | Visitor analytics for our website and the websites the product generates for you; Google Ads measurement is used only when separately enabled and you consent to marketing and advertising cookies | United States | marketingplatform.google.com |
| Meta Platforms, Inc.Consent controlled | Optional Meta Pixel and Conversions API advertising measurement using consented _fbp/_fbc browser identifiers, safe public page origin/path, browser IP/User-Agent network metadata, pseudonymous event references, event type/time, and bounded conversion value/currency; off by default and disabled in HIPAA mode | United States / Global | facebook.com |
| Reddit, Inc.Consent controlled | Optional Reddit Pixel and Conversions API v3 advertising measurement using the consented _rdt_uuid browser identifier, safe public page origin/path, browser IP/User-Agent network metadata, pseudonymous event references, event type/time, and bounded conversion value/currency; off by default, disabled in HIPAA mode, and controlled by exact marketing consent plus GPC/DNT | United States / Global | reddit.com |
| DataFast | Privacy-minimized public-website analytics and campaign attribution; US measurement is default-on, EEA/UK/CH/unknown regions require analytics consent, and GPC/DNT disables it everywhere | United States | datafa.st |
| Sentry | Error monitoring to keep the product reliable | United States | sentry.io |
| ipwho.is (Geo-IP) | Approximate location (country/region) from an anonymized IP, for analytics | Varies | ipwho.is |
Customer Support
| Name | Purpose | Location | Website |
|---|
| Intercom | Customer support messaging | United States / EU | intercom.com |
