These are the companies The Overton Window Company, Inc. engages to run GBrain and that may process personal data from your workspace. The Data Processing Addendum authorizes them (Annex 3), and Privacy explains the rest of how we handle data.
When says which workspaces a subprocessor touches: always means every workspace; by default means every workspace unless it turns the feature off or limits its AI routing; when turned on means only workspaces that switch the feature on or pick that model. Where is where the company says it processes the data. Safeguard is what covers a transfer of personal data from the EEA, the UK or Switzerland to that company. We checked each on the date shown.
Running the service
| Subprocessor | What for, and what it receives | When, and where | Safeguard (checked) |
|---|---|---|---|
| Fly.io, Inc. | Hosts our servers, each brain’s own machine and encrypted storage, and our database. Receives everything in the service | Always; US (Chicago) | EU-US Data Privacy Framework; Fly’s DPA is being signed (2026-10-31) |
| Tigris Data, Inc. | Stores files dropped into chat, workspace pictures and data exports. Receives those files | Always; US, with copies cached near where a file is read | Tigris’s DPA with the EU Standard Contractual Clauses (SCCs); we are confirming with Tigris that it covers storage bought through Fly (2026-10-31) |
| Stripe, LLC | Subscription billing and payments. Receives the payor’s name and email, card details on Stripe’s own pages, invoices | Paying workspaces; US | Data Privacy Framework; Stripe’s Data Transfers Addendum with the SCCs (2026-10-30) |
| Resend | Sends our email: sign-in links, notices, invitations. Receives recipient addresses and the email’s content | Always; US | Data Privacy Framework (not covering HR data); Resend’s DPA with the SCCs (2026-10-31) |
| Functional Software, Inc. (Sentry) | Error reports when something fails. Receives technical details of the error; we don’t store IP addresses there | Always; US | Data Privacy Framework (not covering HR data); Sentry’s DPA (2026-10-30) |
| Rocketship, LLC (Terminalwire) | Serves the installer for the GBrain command-line tool. Receives the IP address and browser of whoever downloads it; command-line sessions connect to our own servers, not to Terminalwire | When someone installs the command-line tool; US | None in place yet (2026-10-30) |
AI models
| Subprocessor | What for, and what it receives | When, and where | Safeguard (checked) |
|---|---|---|---|
| Anthropic PBC | The default AI model; an automated check that reviews recent conversation snippets, with secrets removed, for failures. Receives prompts, with the context and files a brain sends | By default; Anthropic routes calls to the US, Europe, Asia or Australia and stores data in the US | SCCs in Anthropic’s Commercial Terms (2026-10-31) |
| OpenAI OpCo, LLC | Embeddings for memory search, and OpenAI models when a workspace picks one. Receives prompts; the text of memory being indexed | By default; OpenAI’s global endpoint, not pinned to one region | OpenAI’s DPA, signed 2026-10-31 |
| Unmetered Machines, Inc. (Particle) | The Particle-1 model, when a workspace picks it. Receives prompts | When turned on; US | None in place. Don’t pick it for personal data from the EEA, the UK or Switzerland (2026-10-30) |
| ZeroEntropy, Inc. | Embeddings for memory search, for older brains not yet moved to OpenAI. Receives the text of memory being indexed | By default, older brains only; not yet confirmed | None in place yet; a DPA is requested (2026-10-31) |
Tools a brain can use
| Subprocessor | What for, and what it receives | When, and where | Safeguard (checked) |
|---|---|---|---|
| Exa Labs, Inc. | Web search. Receives search queries, which can name people | By default; US | SCCs in Exa’s DPA, part of its terms (2026-10-30) |
| SideGuide Technologies, Inc. (Firecrawl) | Fetching web pages. Receives the addresses fetched | By default; US | None at our plan (2026-10-30) |
| Perplexity AI, Inc. | Research answers. Receives queries | When turned on; US | SCCs in Perplexity’s DPA, incorporated by its API terms; no longer in the Data Privacy Framework (2026-10-31) |
| Captain Technologies, Inc. | Company and investor lookups. Receives queries | When turned on; US or EU | None in place yet; a DPA is requested (2026-10-31) |
| Happenstance, Inc. | People and network search. Receives names and queries | When turned on; US | None in place (2026-10-30) |
| Crustdata Technologies Inc. | Details about a person from a LinkedIn address. Receives LinkedIn addresses and names | When turned on; US | None in place (2026-10-30) |
| X Corp. | Reading and posting on X. Receives queries and posts | When turned on; US | Data Privacy Framework (2026-10-30) |
| Alohi SA (Fax.Plus) | Sending faxes. Receives the fax and the recipient’s number | When turned on; Switzerland (Zurich and Geneva) | Switzerland has an EU adequacy decision; a DPA is requested (2026-10-31) |
Captain, Happenstance, Crustdata and X can also run on a key a person connects themselves. Then their own terms with that company govern it.
Messaging
| Subprocessor | What for, and what it receives | When, and where | Safeguard (checked) |
|---|---|---|---|
| Something Great Inc. (Photon) | Carries iMessage conversations (a pilot). Receives phone numbers, messages and photos | When turned on; US | None in place, and its terms forbid special-category data (2026-10-30) |
| Telegram Messenger Inc. | Carries Telegram conversations with a workspace’s bot. Receives messages and the people in them | When turned on; The Netherlands, for people who signed up to Telegram in the EEA or the UK | None. Telegram acts for itself as a controller of its users’ data (2026-10-30) |
Our website
| Subprocessor | What for, and what it receives | When, and where | Safeguard (checked) |
|---|---|---|---|
| Plausible Insights OÜ | Counts page views on our public pages, without cookies. Receives page views | Public pages only; Germany | No transfer: an EU company on EU servers (2026-10-30) |
| OpenGraph+ | Draws the preview pictures when someone shares one of our public pages. Receives screenshots of public pages | Public pages only; US | No personal data from workspaces (2026-10-30) |
What isn’t on this list
Accounts and applications you connect. When someone in your workspace connects their own Google, Microsoft, Slack, GitHub or Zendesk account, or an application from the directory, the brain works in that account on your instruction, under your own terms with that company. Those companies aren’t our subprocessors. The content still passes through our servers in the US while the brain reads or writes it.
Your own models. A workspace can add its own AI endpoint, for example one in the EU or on its own servers. That provider is chosen and contracted by the workspace, not by us.
Sign-in. Google, Microsoft and GitHub confirm who you are when you sign in with them, as controllers of their own accounts.
Keeping data from the EEA, the UK and Switzerland in bounds
We process your workspace in the United States, under the EU Standard Contractual Clauses in our DPA. Our transfer impact assessment, which follows the European Data Protection Board’s Recommendations 01/2020, concludes that ordinary business data can be transferred under the Clauses with the safeguards we have. Special-category data, and HR, legal or health work, carry more risk. For those, a workspace should set its AI routing to Only approved with an EU model or its own, and leave off every subprocessor above that has no safeguard in place. A workspace for HR, legal or health data under GDPR is the checklist. A customer’s data protection officer can ask for the full assessment at support@gbrain.io.
Changes to this list
We email workspace admins at least 30 days before we add or replace a subprocessor that processes personal data from customer workspaces, and a customer may object in that time (DPA section 6). In an emergency, such as a subprocessor going out of business, we tell admins as soon as we can.