# Annotate Subprocessors

Status: production pilot statement.

Current subprocessors and infrastructure providers used by the shared deployment:

| Provider | Purpose | Data processed |
| --- | --- | --- |
| Railway | API hosting and SQLite volume | Account, project, report, audit, billing metadata, and diagnostics. |
| Cloudflare Pages | Dashboard and landing hosting | Static application assets and request metadata. |
| Google Cloud Storage | Screenshot and backup object storage when configured | Screenshots and database backup replicas. |
| Anthropic | AI triage and real-file AI PR generation when platform Anthropic or project BYO Anthropic is explicitly triggered | Redacted report text, diagnostics, repository context, and triage context. |
| OpenAI | AI triage and real-file AI PR generation when platform OpenAI or project BYO OpenAI is explicitly triggered | Redacted report text, diagnostics, repository context, and triage context. |
| Resend | Email notifications and password reset mail when configured | Recipient email addresses and notification content. |
| Stripe | Billing checkout, portal, and subscription webhooks when configured | Billing identity, subscription, and payment metadata. |
| GitHub | Customer-authorized issue/PR creation when configured | Redacted report context and customer repository metadata. |
| Slack | Customer-authorized webhook notifications when configured | Redacted report notification content. |

Customers handling regulated data should approve subprocessors and widget capture settings before production rollout. Dedicated regional or regulated deployments require a separately agreed architecture and contract addendum.