Subprocessors
These are the third parties that process data on our behalf in order to deliver the Service. Each is bound by a data processing agreement, and each receives only what its function needs.
Large language model inference — generating your agent’s replies.
Processes Conversation content and the context your agent sends with a turn.
Region United States
Infrastructure hosting for the control plane and your agent’s container.
Processes Everything the Service stores, at rest and in transit within the platform.
Region US East (Virginia) or London, per your pinned region
Object storage — audit and compliance exports you request, documents your agent generates, and files you upload to a chat.
Processes The contents of those exports, documents and uploads.
Region US or EU, per your pinned region
Payment processing and subscription billing.
Processes Name, email, billing address, payment card details (collected by Stripe directly).
Region United States
Transactional email delivery — sign-in links, account and security notices.
Processes Email address and the content of the transactional message.
Region United States
Static hosting for this marketing website.
Processes Standard web server logs. No account or agent data is held here.
Region United States
Application telemetry — traces and performance metrics.
Processes Operational metadata only. No message content or agent output is sent.
Region United States
Carrying messages on the channel you connect, and only that one — Telegram, Meta (WhatsApp), Slack, or your SMS/RCS provider (Twilio, Telnyx or Sinch, depending on the deployment).
Processes Your address on that channel and the content of messages to and from your assistant.
Region Per provider
What is deliberately not on this list
We do not use a third-party product-analytics service, and we do not use a third-party error-monitoring service. There is no analytics tag, advertising pixel, or cross-site tracker on this website, and application errors are captured in our own server logs rather than sent to an external service. If either changes, this page changes first.
We also do not use a third-party authentication provider: sign-in links are issued and verified by Wrasse itself, so no identity vendor holds your email address on our behalf.
Notice of changes
We will update this page before adding a subprocessor that processes customer content. If you would like to be told when it changes, write to security@wrasse.ai and we will add you to the notice list. Customers with a signed data processing agreement receive notice under the terms of that agreement.
Related
- Privacy Policy — what we collect, why, how long we keep it, and your rights.
- Security — isolation, credential custody, encryption, and our certification roadmap.
- A copy of our data processing agreement is available on request from security@wrasse.ai.