Legal
Sub-processors
Effective [COUNSEL: effective date]
Draft for legal review. Not in effect.
This version is waiting for review by our lawyers. Text in square brackets and the notes marked "For counsel" are open choices, not final wording. The terms in effect today are the ones published on gryz.ai.
Current list
These services help us run Gryz. Each one gets only the data it needs for its job, and is bound by data protection terms. We host Gryz and store data in the United States.
| Service | What it does | Where |
|---|---|---|
| Vercelvercel.com | Hosting. Every request to Gryz passes through Vercel, which may log request details (IP address, path, browser) for a short time for security and reliability. | United States |
| Supabasesupabase.com | Database, sign-in and sessions. Stores documents, notes, memory, company content, company records, account emails and search indexes. | United States |
| Cloudflarecloudflare.com | Search (Workers AI). Text of memories, documents and notes that are indexed, and search queries, are sent to compute embeddings and rank results. The results are stored in Supabase. | United States [confirm Workers AI location] |
| Resendresend.com | Email. Sends sign-in links, invitations and account and company notices to the email address they go to. | United States |
| Sentrysentry.io | Error tracking. Receives request path, browser type and a cleaned stack trace when something breaks. No document content. | United States [confirm Sentry data region] |
| PostHogposthog.com | Product analytics and masked session replay, tied to an account id once someone signs in. No email addresses, keys or document content. | United States |
| Stripestripe.com | Payments. Handles billing for paid plans. We keep only the Stripe customer id and subscription status. | United States [Stripe may be its own controller for payments, not our sub-processor] |
| Upstashupstash.com | Rate limiting. Keeps short-lived counters, such as tool calls per account or key and failed admin sign-in attempts. No document content. | [confirm Upstash region in the Upstash console] |
| Cloudflare Turnstilecloudflare.com | Bot checks. Checks the challenge a browser completes before an anonymous publish is saved. Cloudflare sees the browser and IP address for the check. | United States [confirm Turnstile location and role] |
| Google Analyticsgoogle.com | Website analytics. Loaded only in production and only when our measurement id is set. Receives page views, browser details and IP address. | United States [keep or remove Google Analytics] |
For counsel [COUNSEL]: Location check needed before merge. Supabase (AWS us-east-2) and PostHog (us.i.posthog.com in the code) are US. Vercel runs a global edge network, so a request can pass through a point near the user before it reaches the US. Cloudflare Workers AI runs on Cloudflare's global network. Confirm the Sentry and Resend data regions on their dashboards. Upstash, Cloudflare Turnstile and Google Analytics were found in the code and added in this draft; they were not in the Privacy Policy before. Confirm the Upstash region (not visible in the code), whether Turnstile makes Cloudflare our sub-processor or its own controller, and whether Google Analytics stays on, since the Privacy Policy previously named only PostHog for analytics.
Not on this list
AI apps that you or your company connect to Gryz, such as Claude, ChatGPT or Cursor, are not our sub-processors. You or your company choose them and send data to them under your own agreement with their provider. Google and GitHub sign-in are identity providers you choose when you sign in.
Changes to this list
We update this page before a new sub-processor starts. For companies, we email owners at least [30] days before, and they can object as set out in our Data Processing Addendum.
Contact
Questions about a service on this list? Email us at info@grtwo.com.