Angada AI uses the third-party sub-processors listed below to operate the service. This list is the single source of truth referenced by our Privacy Policy and Data Processing Agreement. We give at least 30 days' notice before adding or replacing a sub-processor, and each sub-processor is bound by data-protection obligations no less protective than ours.
Last updated: 4 October 2026
| Provider | Purpose | Data | Region | Transfer mechanism |
|---|---|---|---|---|
| Supabase | Application database (accounts, identifiers, encrypted tokens, configuration) | Account data | EU | Processing in region |
| Fly.io | Application / API hosting | Account data, telemetry | EU (Frankfurt) | Processing in region |
| Vercel | Website & app hosting (data in transit) | Data in transit | US | SCCs |
| Cloudflare | R2 storage of encrypted backups and review artefacts; network tunnel/proxy | Backups, review artefacts | EU (R2), global edge (network) | SCCs where applicable |
| OpenRouter | LLM gateway routing inference requests to model providers | Repository content, review findings, workspace memory text | US | SCCs |
| Model providers selected by OpenRouter — Qwen (Alibaba), Moonshot AI, DeepSeek, Z.ai, OpenAI, TypeSafe | AI inference producing code reviews and wikis | Repository content, review findings | US / CN | Provider terms — see note below |
| Daytona | Sandboxed analysis environments that clone the repositories under review | Repository content | EU | Provider terms |
| PostHog | Optional product analytics and onboarding session replay (browser capture only after opt-in consent) | Usage data | EU | Processing in region |
| Sentry | Error & performance monitoring | Diagnostics | EU | Processing in region |
| BetterStack | Telemetry / observability (API) | Operational logs and traces | EU | Processing in region |
| Grafana Cloud | Telemetry / observability (review engine) | Operational logs and traces | UK | UK adequacy decision |
| Infisical | Secrets management | Configuration secrets (no personal data) | EU | Processing in region |
| GrowthBook | Feature flags | Pseudonymous identifiers | US | SCCs |
| Resend | Transactional email (account authentication email) | Email address | US | SCCs |
| Zoho Mail | Support correspondence | Correspondence | EU | Processing in region |
| Slack | Message delivery to your workspace | Message content you direct to Slack | US | Provider terms |
| GitHub | Source of repository and pull-request data; receives posted reviews and checks | Repository content, account identifiers | US | Provider terms |
| Hetzner | Self-hosted marketing-campaign tool | Contact data | EU (Falkenstein) | Processing in region |
| Paddle | Payments & billing — merchant of record | Billing data | UK | UK adequacy decision |
About model providers. Inference requests are routed through OpenRouter, which publishes each provider's data-retention and training policy. Our OpenRouter routing is configured to exclude providers that train on prompts, and several of the providers we use apply zero retention. See OpenRouter's provider-logging documentation for each provider's current policy. Repository content sent to produce a review is covered by this list; we do not use your repositories to train our own models.
Contact: questions about this list: hello@angada.ai.