Subprocessors
These are the third parties that process data on our behalf in order to deliver the Service. We require each to be bound by a data processing agreement, and each receives only what its function needs.
Large language model inference — generating your agent’s replies.
Processes Conversation content and the context your agent sends with a turn.
Region United States
Hosting for your agent’s container and its volume.
Processes What your agent works with during a turn, and the files on its volume.
Region US East (Virginia) or London, pinned per agent
Hosting for the control plane and its databases — your account, conversations, connected-account tokens and audit log.
Processes Account data, conversations, the audit log, and connected-account tokens (encrypted). Files are with Cloudflare R2, and billing with Stripe (below).
Region A single region, which may differ from your agent’s; details on request
Object storage — audit and compliance exports you request, documents your agent generates, and files you upload to a chat.
Processes The contents of those exports, documents and uploads.
Region A single storage location for all accounts
Payment processing and subscription billing.
Processes Name, email, billing address, payment card details (collected by Stripe directly).
Region United States
Transactional email delivery — sign-in links, account and security notices.
Processes Email address and the content of the transactional message.
Region United States
Static hosting for this marketing website.
Processes Standard web server logs. No account or agent data is held here.
Region United States
Application telemetry — traces and performance metrics.
Processes Operational metadata only. No message content or agent output is sent.
Region United States
Carrying messages on the channel you connect, and only that one — Telegram, Meta (WhatsApp), Slack, or your SMS/RCS provider (Twilio, Telnyx or Sinch, depending on the deployment).
Processes Your address on that channel and the content of messages to and from your assistant.
Region Per provider
What is deliberately not on this list
We do not use a third-party product-analytics service, and we do not use a third-party error-monitoring service. There is no analytics tag, advertising pixel, or cross-site tracker on this website, and application errors are captured in our own server logs rather than sent to an external service. If either changes, this page changes first.
We also do not use a third-party authentication provider: sign-in links are issued and verified by Wrasse itself, so no identity vendor holds your email address on our behalf.
Notice of changes
We will update this page before adding a subprocessor that processes customer content. If you would like to be told when it changes, write to security@wrasse.ai and we will add you to the notice list. Customers with a signed data processing agreement receive notice under the terms of that agreement.
Related
- Privacy Policy — what we collect, why, how long we keep it, and your rights.
- Security — isolation, credential custody, encryption, and our certification roadmap.
- Ask security@wrasse.ai where our data processing agreement stands.