Subprocessors
Effective 9 November 2026
These are the companies that help us run Zoex and may process Customer Data for it. Each works under a contract that limits it to that work and requires it to protect the data.
Draft: the company’s legal details are still to be added.
Hosting and storage
| Company | What they do for us | Data | Where |
|---|---|---|---|
| Supabase | Database, file storage and sign-in | Account data and Customer Data | EU (Frankfurt) |
| Vercel | Hosting the app and the website; routing some AI requests (AI Gateway) | All data in transit; request logs | EU (Frankfurt) for the app; global edge network |
| Mesa | Keeping the versions of Brain pages | Text of Brain pages | United States |
AI models
| Company | What they do for us | Data | Where |
|---|---|---|---|
| Anthropic | The Claude models that power Zoex | What a task needs, while Zoex works on it | United States |
| OpenAI, Google and Moonshot AI (through Vercel’s AI Gateway) | Some side tasks: checking a change, watching a video, making ad images | What that task needs, with zero data retention | United States |
| Voyage AI | Search over notes and skills (embeddings and ranking) | Text of notes, pages and search requests | United States |
| ElevenLabs | Turning voice into text when you teach Zoex by recording | The recording’s audio | United States |
Doing the work
| Company | What they do for us | Data | Where |
|---|---|---|---|
| Composio | Connecting the other apps you choose to connect | Connection credentials; what a task reads or changes in those apps | United States |
| E2B | Isolated computers where Zoex runs code for a task | Files and data of that task | United States |
| Exa | Searching the web and finding companies, when asked | Search words and descriptions | United States |
| Firecrawl | Reading public web pages and watching them for changes, when asked | Web addresses and public page content | United States |
| ScrapeCreators | Reading public ad libraries, TikTok Shop and Reddit, when asked | Brand names and search words | United States |
| Resend | Sending account emails and the emails you ask Zoex to send; receiving emails for automations | Email addresses and email content | United States |
Running the business
| Company | What they do for us | Data | Where |
|---|---|---|---|
| Stripe | Payments, invoices and tax | Billing contact and payment details | United States |
| Cloudflare | The security check on sign-in forms (Turnstile) | Browser and device signals, IP address | Global |
| Axiom | Operational logs | IDs, counts and timings only, never content | EU or United States, as configured |
| Braintrust | Reviewing the quality of Zoex’s work, only for companies that agree to it | The steps of a task, with emails and phone numbers masked | United States |
Services you connect
These aren’t our subprocessors: they are services your company chooses to connect. They receive data only because, and as far as, you connect them, under your own agreements with them.
- Shopify
- Google Ads
- Google Analytics
- Slack
- Your own email domain (through Resend)
- Apps connected through Composio, such as Gmail, Google Sheets, Notion or HubSpot
Changes
Before a new subprocessor starts handling Customer Data, we add it here. Customers with a signed data processing agreement are told in advance by email and may object as that agreement describes. Questions: [contact email].