Sub-processors
The third parties SafeGora engages to deliver the Services. We notify customers at least 30 days in advance of any addition or replacement, and customers may object on reasonable data-protection grounds under Terms of Service section 10 or an executed DPA.
Status-honest sub-processor list (not a signed DPA exhibit by itself).
This page is the customer-facing stable URL for the current list. Rows marked as an open item do not yet have a confirmed signed vendor DPA on file. This is not a claim of SOC 2 certification, a completed trust center, or that all enterprise integrations are live.
As of: October 28, 2026. Changes require an entry in the change history below and customer notification under section 10 of the Terms of Service or an executed Data Processing Addendum.
Notice of change. SafeGora will provide at least thirty (30) days' advance notice before adding or replacing a sub-processor. Customers who have subscribed to sub-processor change notifications via Ollie@safegora.com will receive the notice by email. Customers may object on reasonable data-protection grounds within the notice window; if the parties cannot reach a commercially reasonable resolution, the customer may terminate the affected Services without penalty and receive a refund of unused prepaid fees, as set out in Terms of Service section 10 or an executed DPA.
Active sub-processors
| Vendor | Service provided | Categories of data Processed | Processing location | DPA note |
|---|---|---|---|---|
| Google Cloud Platform (Google LLC) | Primary cloud infrastructure: compute (Cloud Run), managed PostgreSQL (Cloud SQL), object storage (Cloud Storage), networking (VPC, Load Balancer, Cloud Armor), observability (Cloud Logging, Cloud Monitoring), secret storage (Secret Manager), managed container registry (Artifact Registry), Pub/Sub, Cloud DLP inspection used on selected free-text paths, and reCAPTCHA Enterprise bot checks on public forms where enabled. | Customer Personal Data at rest and in transit within the SafeGora platform (tenant-scoped application data, filings artifacts, audit records). For reCAPTCHA Enterprise: the form submission's browser, device and interaction signals used to score bot risk. | us-west1 (United States) — primary data plane | Google Cloud Data Processing Addendum (account-level). |
| Google Vertex AI / Gemini (Google LLC) — AI inference paths | Generative AI and embeddings used by SafeGora product features (compliance assistance, document/vision/voice paths where enabled, retrieval embeddings). All calls go through the SafeGora LLM facade (kill switches, budgets, PII redaction, grounding) before any external model endpoint. | Tenant-context prompts after ingestion-time and request-time PII redaction where applied; regulatory and tenant chunk text used for embeddings; AI usage telemetry (model, intent, token counts, latency, cost) for governance accounting. | Text generation: Vertex AI global endpoint. Google can serve a global-endpoint request from any of its regions, so this is not a United States-only commitment. Embeddings: Vertex AI us-west1 (United States). | Covered by the Google Cloud Data Processing Addendum and Service Specific Terms, under which Google does not use the data to train its models without SafeGora's permission. |
| WorkOS, Inc. | Browser authentication (User Management SDK): password, Magic Auth, and social OAuth code exchange; sealed-session cookie issuance; authentication audit events. Enterprise SSO (SAML/OIDC) via WorkOS is planned / deferred — not presented as a completed buyer-live product claim today. SafeGora does not offer multi-factor authentication through WorkOS or otherwise; sign-in uses the methods listed here. | Authentication identifiers (email, tenant association), session credentials, login event records. | United States | Open item: SafeGora has not yet confirmed a signed WorkOS DPA on file. |
| Stripe, Inc. | Subscription billing: checkout, card tokenization, payment-method storage, invoicing, and subscription lifecycle webhooks. | Billing contact name and email, payment-method tokens (card PAN data is tokenized by Stripe and does not rest in SafeGora systems), invoice and subscription metadata. | United States | Stripe Services Agreement + Data Processing Agreement. |
| Google Workspace (SMTP relay) | Transactional email via application SMTP (account verification, password reset, invites, notifications, filing-related mail). | Recipient email address, sender identity, message subject and body (may include incident or training metadata as configured by Customer use). | United States (Google Workspace / GCP agreements) | Covered under Google Workspace / Google Cloud agreements. |
| Cloudflare, Inc. | Authoritative DNS for safegora.com and related hostnames. SafeGora does not rely on Cloudflare Workers as a Customer Personal Data processing plane. | DNS query metadata for public hostnames. Marketing/public request metadata may transit CDN/DNS edges where enabled. | Global DNS edge; no claim of Customer data residency on Cloudflare compute | Open item: SafeGora has not yet confirmed a signed Cloudflare DPA on file. |
AI sub-processor notes (honest)
SafeGora routes product AI through an internal LLM facade with tenant-aware PII redaction and grounding controls before requests leave the control plane. Product AI uses Google Cloud Vertex AI under SafeGora's Google Cloud agreement; it does not use the consumer Gemini API. Text generation uses the Vertex AI global endpoint, so Google may process a request in any of its regions. Embeddings use Vertex AI in us-west1. Procurement teams that need United States-only AI processing should raise it before ordering.
Google's commitments for Google Cloud services are documented in the Google Cloud Data Processing Addendum and Google Cloud Service Specific Terms.
Not listed as active sub-processors (audit clarity)
- Sentry, PagerDuty, public status-page providers — not enabled in production; not production Customer Personal Data processors.
- Anthropic — not used for production product AI calls.
- AI hosts a user connects (OpenAI, Anthropic, Meta, xAI) — a host receives results only when a user connects it. That is a customer-enabled integration, not a sub-processor; see the ChatGPT and AI connection notices.
- AWS / Azure — not the primary application cloud (single-cloud Google Cloud posture).
- Customer IdPs (Okta, Azure AD, Google Workspace as IdP) — when enterprise SSO ships, federation is planned via WorkOS enterprise connections; that path is deferred (see trust SSO runbook). Customer IdPs are not SafeGora-subscribed subprocessors.
Affiliates and intra-group processing
OllieLabs LLC has no subsidiaries that Process Customer Personal Data at this time. If that changes, the affiliate will be added to this list with the same 30-day advance notice discipline as any third-party sub-processor.
Transfer mechanisms
Primary application data plane is the United States (us-west1); AI text generation uses a global endpoint as described above. SafeGora offers the Services to United States customers. Where a customer needs EU Standard Contractual Clauses or the UK International Data Transfer Addendum, those instruments apply only when set out in an executed SafeGora DPA. Each sub-processor relationship is intended to be governed by a written agreement imposing data-protection obligations no less protective than Terms of Service section 10; open vendor DPA items are called out above.
Change history
| Effective date | Change |
|---|---|
| 2026-10-28 | Corrected the Vertex AI / Gemini entry: product text generation runs on the Vertex AI global endpoint, not the consumer Gemini API, and is not a United States-only commitment; embeddings stay in us-west1. Named reCAPTCHA Enterprise under the Google Cloud entry. Section references now point to Terms of Service section 10 or an executed DPA. No vendor was added or replaced. |
| 2026-09-26 | Corrected the WorkOS service description: SafeGora does not offer multi-factor authentication, so it is no longer described as planned. Enterprise SSO remains planned / deferred. No sub-processor, processing activity or location changed. |
| 2026-07-19 | Honesty alignment with the internal vendor management register: listed Google Workspace SMTP as the transactional email path; removed vendors not confirmed as production subprocessors in the register (e.g. third-party ESP / unconfirmed error trackers); expanded AI endpoint honesty (Vertex embeddings vs consumer Generative Language API for text inference); added this change-history section for procurement audit trail. |
| 2026-07-14 | Retired Firebase Cloud Messaging (Google LLC) as a sub-processor. Push notification delivery uses the open Web Push standard served directly by SafeGora on Google Cloud (no separate messaging sub-processor); previously stored device push registration tokens were deleted. |
| 2026-05-27 | Added Google Cloud Vertex AI / Gemini entry for generative AI features that route through the SafeGora LLM facade. |
Sub-processors retired (retained for audit trail)
Firebase Cloud Messaging (Google LLC) — retired effective July 14, 2026. Push notification delivery now uses the open Web Push standard served directly by SafeGora on Google Cloud. Previously stored device push registration tokens were deleted.
Firebase / Identity Platform (GCIP) — fully off-boarded as the browser authentication path (WorkOS is the auth processor for all environments).
Subscribe to change notifications
To receive at least 30 days' advance email notice of any sub-processor change, email Ollie@safegora.com with subject Subprocessor change notifications. We will add the requested address to the notification distribution.
Contact
Questions about a listed sub-processor, redline requests, or data-protection objections: Ollie@safegora.com.
Last updated October 28, 2026 — corrected the AI processing path and location and named reCAPTCHA Enterprise; no vendor was added or replaced. SafeGora does not offer multi-factor authentication.