Jorcks Consult ApS (CVR 39555492) uses the following providers to operate Kenosis. Each provider in active use is bound by a data processing agreement not to use your data for anything beyond providing its service to us. Providers marked "not yet active in production" receive no customer data, and their agreement is in place before they are switched on. Transfers to the US rely on the EU-US Data Privacy Framework (DPF) where the provider is certified, and on the EU Standard Contractual Clauses (SCCs) in each provider's DPA. DPF status was checked against the official DPF list (dataprivacyframework.gov) on 8 October 2026.
| Provider | Purpose | Data | Region | Transfer basis | DPA |
|---|---|---|---|---|---|
| Vercel Inc. (US) | Hosting and application compute | All data passing through the app | Functions: EU (Dublin); control plane: US | DPF (certified) + SCCs | vercel.com/legal/dpa |
| Supabase Pte. Ltd (Singapore) | Database, sign-in and file storage | All stored data | EU (Ireland, eu-west-1) | SCCs | supabase.com/legal/dpa |
| Anthropic (US; EU contracting entity Anthropic Ireland Limited) | AI model inference | Conversation content sent to the model | US | SCCs (Modules 2 and 3); not DPF-listed | anthropic.com/legal/data-processing-addendum |
| Voyage AI Innovations, Inc. (US, a MongoDB company) | Text embeddings for memory search | Text of messages, files and memory | US | DPF (covered under MongoDB, Inc.'s certification) + SCCs | voyageai.com/dpa |
| Stripe | Payment processing | Billing contact and payment data | Stripe's own infrastructure, as set out in its DPA | DPF (Stripe, LLC certified) + SCCs | stripe.com/legal/dpa |
| Functional Software, Inc. d/b/a Sentry (US) | Error monitoring | Error reports, scrubbed of personal data | Error payloads: EU (Frankfurt); account and organisation metadata: US | DPF (certified) + SCCs | sentry.io/legal/dpa |
| UptimeRobot s. r. o. (Slovakia) | Uptime monitoring | None: checks only public URLs | EU, with US hosting by its own sub-processors | SCCs for its onward transfers | uptimerobot.com/dpa |
| Google LLC (US) | Sending sign-in and notification email (Google Workspace); the Gmail, Drive and Calendar integration an organisation chooses to connect | Recipient email addresses and email content we send; for connected accounts, the queries and calendar entries Kenosis sends | Google's own infrastructure, as set out in its DPA | DPF (certified) + SCCs | cloud.google.com/terms/data-processing-addendum |
| Microsoft Corporation (US) | The Microsoft 365 integration (Outlook mail and calendar, via Microsoft Graph) an organisation chooses to connect (not yet active in production) | The queries Kenosis sends to the connected account | Microsoft's own infrastructure, as set out in its DPA | DPF (certified) + SCCs | Microsoft Products and Services DPA |
| Deepgram, Inc. (US) | Speech-to-text for voice input (not yet active in production) | Voice recordings a user chooses to dictate | US | SCCs; not DPF-listed | Provided on request by Deepgram; no public URL |
| OpenAI (US; EEA contracting entity OpenAI Ireland Ltd) | Image generation (not yet active in production) | Image prompts | US | SCCs; not DPF-listed | DPA executed 12 Oct 2026 (openai.com/policies/data-processing-addendum) |
| Slack Technologies, LLC (US) | The Kenosis Slack app, for organisations that install it | Slack messages addressed to the assistant, and the ids of the Slack users and channels involved | US | SCCs | Slack's standard DPA, accepted at install |
| Twilio Inc. (US) | SMS, for organisations that connect an SMS number (not yet active) | Texts sent to and from the organisation's number, and the phone numbers involved | US | SCCs | Twilio's DPA, to be accepted when the account is opened |
Integrations an organisation connects itself. For Google and Microsoft, the mailbox, files and calendar stay in the organisation's own Google or Microsoft account, under the organisation's own agreement with that provider. They are listed above because Kenosis sends queries and calendar entries to them. Any third-party tool connected through the MCP catalog is the organisation's own vendor, not our sub-processor.
Not listed, because they hold no customer data: GitHub (source code and CI) and Hetzner (a CI runner).
We will update this page before adding or replacing a sub-processor. Organisations with a signed data processing agreement are notified in advance, as that agreement provides.