Sub-processors
Effective October 25, 2026
Roborian, Inc. ("Roborian") uses the third parties below to deliver OKiDO. Each of them processes personal data on our behalf, and on behalf of our customers, only to provide the service described, under a written agreement with data protection obligations no less protective than those in our Data Processing Agreement.
| Sub-processor | Purpose | Personal data | Location |
|---|---|---|---|
| OVH SAS (OVHcloud) | Hosting of the application servers and databases | All data stored in the Service | France (EU) |
| Anthropic, PBC | AI processing for agents, chat, and code generation | Prompts and the task, process, and document context needed for the request | United States |
| OpenAI, LLC | AI processing for agents, chat, transcription, agent memory, and code generation | Prompts and the task, process, and document context needed for the request; audio you choose to transcribe | United States |
| Cloudflare, Inc. | Content delivery, DDoS protection, and object storage (R2) | Uploaded files, recordings, avatars, and request metadata | Global (US headquarters) |
| Resend, Inc. | Email delivery | Recipient address and message content | United States |
| Stripe, Inc. | Payment processing | Billing email, organization name, and subscription data | United States |
| Google LLC | Analytics through Google Tag Manager (consent-gated in the EU/EEA, UK, and Switzerland) | Page views and interaction events | United States |
AI providers
Anthropic and OpenAI receive only the content needed to answer a request or carry out an agent step. We do not use customer content to train AI models, and under their API terms Anthropic and OpenAI do not use it to train theirs. They may keep inputs and outputs for a limited period to detect abuse, as described in their terms. How OKiDO is classified under the EU AI Act is set out on our EU AI Act page.
International transfers
Where a sub-processor processes personal data from the EU/EEA, the UK, or Switzerland outside those regions, the transfer is covered by the European Commission's Standard Contractual Clauses or, where available, the provider's certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions.
Changes to this list
We update this page at least 30 days before a new sub-processor starts processing customer personal data. If you object to a new sub-processor on reasonable data protection grounds, tell us within that period at [email protected], as described in section 6 of the Data Processing Agreement.