{
  "updated": "2026-10-24",
  "url": "https://screwtape.ai/subprocessors/",
  "notice": "New subprocessors are announced here at least 14 days before they process customer personal data.",
  "subprocessors": [
    {
      "name": "Cloudflare, Inc.",
      "purpose": "Hosting (Workers), database (D1), CDN, DNS and the Workers AI fallback model",
      "data": "All API traffic in transit, D1 rows (keys as hashes, receipts, opt-in retained content), and judged content sent to the Workers AI fallback",
      "location": "United States and Cloudflare's global network",
      "safeguard": "Cloudflare DPA with EU Standard Contractual Clauses (Modules 2 and 3) and EU-U.S. Data Privacy Framework certification"
    },
    {
      "name": "Groq, Inc.",
      "purpose": "Model inference for judge and consensus calls (default model openai/gpt-oss-120b)",
      "data": "Judged content (task, agent output, evidence) for each call",
      "location": "United States",
      "safeguard": "Groq Customer Data Processing Addendum with EU Standard Contractual Clauses"
    },
    {
      "name": "PayPal",
      "purpose": "Card and PayPal payments for packs and plans (PayPal acts as an independent controller for payment data)",
      "data": "Payer name, email, amount and order id. No judged content",
      "location": "United States and PayPal's regions",
      "safeguard": "PayPal's own privacy statement and transfer safeguards"
    },
    {
      "name": "x402 facilitators (x402.dexter.cash, facilitator.xpay.sh)",
      "purpose": "Verify and settle USDC payments; they receive the payment payload only, never judged content",
      "data": "Signed payment payload and public wallet address",
      "location": "Operator-hosted, location not published",
      "safeguard": "No personal data beyond a public wallet address is sent"
    },
    {
      "name": "Public blockchain RPC providers (Base, Solana)",
      "purpose": "Read on-chain payment status",
      "data": "Public transaction hashes and wallet addresses",
      "location": "Various",
      "safeguard": "Only public transaction data is read"
    },
    {
      "name": "Google LLC (Gmail)",
      "purpose": "Support and contact inbox (screwtapedev@gmail.com; security@screwtape.ai forwards to it)",
      "data": "Whatever you choose to email us: name, email address and message content",
      "location": "United States and Google's global network",
      "safeguard": "Google Workspace and Cloud data processing terms with EU Standard Contractual Clauses and EU-U.S. Data Privacy Framework certification"
    },
    {
      "name": "Kit, Inc. (kit.com)",
      "purpose": "Newsletter sign-ups (the newsletter form at screwtape-ai.kit.com)",
      "data": "Subscriber email address. Not API customer data: no keys, judged content or receipts",
      "location": "United States",
      "safeguard": "Kit Data Processing Addendum with EU Standard Contractual Clauses and UK IDTA, and EU-U.S. Data Privacy Framework certification"
    }
  ],
  "changes": [
    {
      "date": "2026-10-24",
      "change": "Correction: Kit, Inc. added. It already held newsletter subscriber emails, and this page wrongly said we use no email marketing service. No new processing started."
    },
    {
      "date": "2026-10-24",
      "change": "Correction: Google LLC (Gmail) added. It already hosted our support inbox and was missing from this list. No new processing started."
    }
  ]
}