SUB-PROCESSORS
Who we share your data with.
A minimal, audited list. Every sub-processor is bound by a data processing agreement with Atlantic. We notify you 30 days before adding new ones.
Last updated: 2026-06-02. We will update this list at least 30 days before adding or replacing any sub-processor. Customers subject to a DPA may object to changes on legitimate data protection grounds. Questions? info@getatlantic.ai.
| Sub-processor | Purpose | Data types processed | Region |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting, compute, storage, and LLM inference via Amazon Bedrock (Anthropic Claude and OpenAI GPT models) | All customer data at rest and in transit; LLM inference inputs/outputs | United States (us-east-1 primary); Bedrock cross-region inference may serve model requests in other AWS regions |
| GitHub | Repository access through the GitHub App you install, and pull request delivery | Repository contents and metadata for the repositories you select; pull requests Factory opens | Per GitHub's terms |
| Dodo Payments | Subscription billing and payment processing | Billing contact details, plan, and PR credit usage; card details are handled by the processor | Per Dodo Payments' terms |
| Supabase | Managed PostgreSQL database hosting | Structured application data (user records, conversations, knowledge base metadata) | EU (eu-central-1) and United States |
| PostHog | Product analytics and session replay | Usage events, feature interaction data, session recordings (analytics only, consent-gated) | European Union (EU Cloud) |
| Resend | Transactional email delivery (account notifications, security alerts, invoices) | Email address, name, email content | United States |
NO-TRAINING COMMITMENT
None of the sub-processors listed above train AI models on your data. AWS Bedrock does not use API inputs for model training. This is contractually guaranteed.
GDPR
All sub-processors are covered by Standard Contractual Clauses (SCCs) for EU/EEA data. Regional data residency is maintained where available.
CHANGE NOTICE
We will email active subscribers at least 30 days before adding or replacing a sub-processor. Enterprise customers may object per their DPA terms.