Snapshot 140329
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
We raised a $10M Series A! To celebrate, we’re offering 50% off Solo and Business plans this week. Sub-processors Last updated 21 October 2026 About this list This is the list of sub-processors referenced by Clueso’s Data Processing Agreement and Privacy Policy. Changes are posted here at least ten (10) business days before they take effect, and customers under a Data Processing Agreement may object within ten (10) business days of an update, on the terms set out in that agreement. Subscribe below to be notified when this list changes. Changes in this update (21 October 2026) Added Baseten, Inc. (large language model inference). This provider was already engaged in the Service, so this update brings the list up to date and takes effect on publication rather than ten (10) business days later. Customers under a Data Processing Agreement may object within ten (10) business days of this update, on the terms set out in that agreement. 1. How this list is scoped Sub-processors are scoped to the modules a customer has enabled. A customer using hosting only receives a materially shorter list than one using recording and generation. The platform group applies to everyone. Customer-connected integrations are not sub-processors and are not listed here. Where a customer connects a third-party platform, the customer holds the agreement and the credentials and the content goes into that customer’s own tenant. See Section 6. 2. Platform Engaged for every customer, including hosting-only. Sub-processor Purpose Location Amazon Web Services, Inc. Cloud infrastructure and storage United States PropelAuth, Inc. Authentication and identity United States Sentry (Functional Software, Inc.) Error monitoring and crash reporting United States PostHog, Inc. Product analytics United States HubSpot, Inc. Customer relationship management United States Loops (Astrodon Corporation) Transactional and notification email United States Stripe, Inc. Payment processing United States Google LLC Website analytics (marketing site only) United States 3. Transcription, generation and media Engaged where the customer records or generates content. Not engaged for hosting-only customers. Multiple providers are retained per capability for redundancy and quality; where a customer restricts Clueso to an approved subset, calls to the remaining providers are excluded for that workspace. Capability Sub-processor Data received Location Speech-to-text Deepgram · AssemblyAI · OpenAI · Google Recording audio United States Large language models Anthropic · OpenAI · Google (Gemini) · Baseten, Inc. Transcript, screenshots, document content United States Text-to-speech ElevenLabs · Cartesia · OpenAI · Google Voiceover script United States Image generation Google · OpenAI Image prompts United States Avatar generation HeyGen, Inc. Voiceover script or audio, and the avatar selected for the video United States Object storage Google Cloud Storage Generated media assets United States LLM observability PostHog, Inc. Model inputs and outputs on instrumented paths United States 4. Automated Recording Engaged only where Automated Recording is enabled. See the corresponding annex in the customer’s Data Processing Agreement for full detail. Sub-processor Purpose Location Browserbase, Inc. The hosted browser session in which a recording run executes United States (us-west-1) Anthropic, PBC Model inference on page state, screenshots and navigation context during a recording run United States 5. Code-Connected Content Generation Engaged only where Code-Connected Content Generation is enabled. See the corresponding annex in the customer’s Data Processing Agreement for full detail. Sub-processor Purpose Location Anthropic, PBC Analysis of connected source code United States GitHub, Inc. · GitLab Inc. · Atlassian Customer-authorised repository access, read-only United States 6. Customer-connected integrations Clueso supports integrations that publish generated content into a platform the customer already uses, such as a documentation or help-centre platform. These are not sub-processors. The customer chooses and connects the integration, holds the account and the credentials, and the content is written into the customer’s own tenant under the customer’s own agreement with that provider. Clueso does not appoint these providers, does not assess them, and does not determine their security, retention or sub-processing practices. Connecting or disconnecting one is within the customer’s control and is not a sub-processor change, so it does not trigger the notice and objection process above. The integrations available to a customer are shown in the product. The same applies to an AI assistant that a user connects to Clueso through the Clueso connector. The user chooses the assistant and uses it under their own agreement with its provider, so it is not a Clueso sub-processor. 7. Controls applying to all sub-processors These apply to the sub-processors in the sections above. They do not apply to customer-connected integrations, which Clueso does not appoint and does not assess. Diligence before engagement — security posture, certifications such as SOC 2 and ISO/IEC 27001, data-residency arrangements and contractual data-protection commitments are assessed before a sub-processor is engaged. Written data processing agreements — covering confidentiality, security, purpose limitation, breach notification and data-subject rights. Standard Contractual Clauses — where the sub-processor processes personal data of individuals in the EEA, UK or Switzerland, together with the UK International Data Transfer Addendum where applicable. Copies are available to customers on request. No training on customer data — AI sub-processors confirm in writing that Clueso customer content will not be used to train any generalised model, will be retained only as long as necessary to deliver the requested processing, and will be deleted consistent with Clueso’s retention schedule. Server-side calls only — all sub-processor calls are made by the application backend. Provider credentials never leave the backend. Annual review — of all AI vendors for continued compliance with security standards and regulatory requirements. 8. Data residency Customer content and the stores holding it are localised to the region the customer selects: Mumbai (ap-south-1), Frankfurt (eu-central-1) or California (us-west-1). Account identity data — name, work email and organisation, containing no customer content — is held in a single global store. The AI sub-processors above are United States services, so at the AI processing step content is transferred outside its storage region. These transfers are covered by data processing agreements incorporating Standard Contractual Clauses where applicable. 9. Retention AI sub-processors do not retain or reuse customer content beyond the defined processing request. Within Clueso, content marked for deletion by the customer is securely deleted or anonymised within a maximum of thirty (30) days. 10. Contact Information Security Officer privacy@clueso.io Desklamp, Inc. d/b/a Clueso Get notified when this list changes We post sub-processor changes here at least ten (10) business days before they take effect. Subscribe and we’ll email you when we do.