Current as of July 18, 2026
Subprocessor Register
The third parties SuperEmber currently authorizes to process Customer Personal Data when providing the service.
How to read this register
A provider is used only when the relevant SuperEmber feature or processing path is active. Processing locations can include the provider's stated region and locations used by its own authorized subprocessors. International transfers are protected as described in the SuperEmber Data Processing Addendum and the applicable provider agreement.
Customer-controlled destinations such as Slack, Microsoft Teams, Discord, email, calendars, storage, and other apps that Customer chooses to connect are not listed as SuperEmber Subprocessors merely because Customer instructs SuperEmber to send data to them. Their own terms apply to Customer's use of those services.
Vercel, Inc.
Function: application hosting, serverless compute, deployment, network delivery, observability, managed blob storage, sandbox and workflow/runtime capabilities. Data: service requests, customer content processed by hosted functions, files and artifacts, identifiers, network and operational metadata. Location/transfer: provider-selected infrastructure and subprocessors, including processing outside the EEA where covered by the provider's transfer safeguards.
Neon, Inc.
Function: managed PostgreSQL database infrastructure. Data: account, organization, agent, workflow, channel, workspace, connector, usage, security, and other application records stored by SuperEmber. Location/transfer: the configured database region and Neon's authorized subprocessors; transfer safeguards apply where processing occurs outside the EEA.
Clerk, Inc.
Function: authentication, identity, organization membership, and account administration. Data: identity and account attributes, authentication events, session and device information, organization membership, and related security metadata. Location/transfer: provider infrastructure and authorized subprocessors, including processing outside the EEA under applicable transfer safeguards.
OpenRouter, Inc.
Function: routing prompts and model inputs to AI model endpoints and returning model outputs. Data: prompts, messages, files or media included in model input, generated output, model and request metadata. Location/transfer: United States and the locations of OpenRouter's authorized downstream providers. SuperEmber requires Zero Data Retention-capable routing and disables provider data collection for these requests.
Sampark Inc. (Composio)
Function: connected-application authorization, connector sessions, tool execution, and trigger delivery. Data: connected-account identifiers and authorization metadata, scoped credentials or tokens, connector instructions, tool inputs and outputs, trigger payloads, and operational metadata. Location/transfer: Composio infrastructure and authorized providers; processing location and transfer safeguards follow the applicable Composio agreement.
Upstash, Inc.
Function: QStash scheduling, queueing, retry, and delivery of workflow and channel tasks. Data: destination and scheduling metadata, task identifiers, signed delivery headers, and task payloads required for the queued operation. Location/transfer: provider infrastructure and authorized subprocessors under the selected service configuration and applicable transfer safeguards.
PostHog, Inc.
Function: consent-gated product analytics, feature flags, and content-minimized operational and AI observability. Data: pseudonymous user and organization identifiers, allowlisted product events, canonical route and bounded attribution data, feature-flag context, and content-minimized model, cost, latency, status, and trace metadata. Location/transfer: PostHog US Cloud and its authorized subprocessors. Browser analytics does not initialize before consent; autocapture and session replay are disabled.
Exa Labs, Inc.
Function: optional public-web search, URL content extraction, and provider-generated search summaries when a Customer enables and uses the research capability. Data: search queries and filters, public URLs submitted for retrieval, requested extraction or summary instructions, and operational metadata. Location/transfer: Exa infrastructure and authorized providers under the applicable agreement. SuperEmber treats Exa as a separate processing path from AI model inference and minimizes query content.
X.AI LLC
Function: optional direct X Search for public posts, users, and threads when a Customer enables and uses the research capability. Data: search questions, X account and date filters, optional image or video understanding instructions, returned public X content, and operational metadata. Location/transfer: United States and xAI's authorized providers under its DPA. This direct search path is separate from OpenRouter model routing; xAI's account-level Zero Data Retention status must be verified for the active API team, otherwise its published default API retention applies.
Change notices and objections
SuperEmber will provide at least 30 days' notice before authorizing a new Subprocessor to process Customer Personal Data. Customers may subscribe to notices or object on reasonable data-protection grounds by emailing privacy@superember.ai. A provider substitution that does not process Customer Personal Data is not a Subprocessor change.
Recently retired processor — Topoteretes UG (Cognee)
Status: inactive. SuperEmber's current production runtime uses canonical Wiki storage and PostgreSQL full-text search; provider-backed Cognee semantic indexing and retrieval are disabled as of July 17, 2026. No new Customer Personal Data is sent to Cognee by the current runtime.
Cognee is disclosed here temporarily because historical semantic-index data may remain in the provider account. SuperEmber will remove Cognee from this register after deletion of that historical data is verified. Cognee must not be re-enabled for Customer Personal Data unless it is first restored to the active register and the required processor contract and transfer safeguards are in place.