# Arrows

Arrows (arrows.to): subprocessors, data processing agreement, security documents and changes, as monitored by Third Party Index.

- Page: https://thirdpartyindex.com/vendors/arrows
- Documents last verified: 2026-10-03
- Transparency rating: 84/100 (how much it publishes, not how secure it is): Subprocessor list 30/30; Processing locations 8/8; Purposes 7/7; Data processing addendum 12/12; Trust center 8/8; Privacy policy 6/6; security.txt 0/6 (not found); Security page 5/5; Status page 0/5 (not found); Vulnerability disclosure 0/5 (not found); Pages still reachable 8/8
- Supply chain: relies on 18 tracked vendors directly, 133 within two hops, 356 within three; 1 tracked vendors rely on it directly, 1 within two hops, 1 within three
- Cite as: Arrows, Third Party Index, https://thirdpartyindex.com/vendors/arrows (data CC BY 4.0)

## Documents

| Document | URL | Last verified | Last changed |
|---|---|---|---|
| Trust center | https://trust.arrows.to/ | 2026-10-03 | 2026-10-03 |
| Subprocessor list | https://trust.arrows.to/subprocessors | 2026-10-03 | 2026-10-03 |
| Data processing addendum | https://arrows.to/dpa/ | 2026-10-03 | 2026-10-03 |
| Privacy policy | https://arrows.to/privacy/ | 2026-10-03 | 2026-10-03 |
| Terms | https://arrows.to/terms/ | 2026-10-03 | 2026-10-03 |
| Security page | https://arrows.to/security/ | 2026-10-03 | 2026-10-03 |

## Subprocessors (21)

As its own list states them.

| Subprocessor | Purpose | Location | Listed since |
|---|---|---|---|
| [Amazon Web Services](https://thirdpartyindex.com/vendors/amazon-web-services.md) | Customer file hosting; Storage for customer-uploaded files | USA | 2026-10-03 |
| [Anthropic](https://thirdpartyindex.com/vendors/anthropic.md) (AI model provider: Anthropic) | Large language models powering AI features; Provider for backend support of AI-powered functionality | USA | 2026-10-03 |
| [Cloudflare](https://thirdpartyindex.com/vendors/cloudflare.md) | DNS, web application firewall, edge compute, file storage, and transactional email.; Web application firewall, backend services, user file hosting, and email delivery | Global | 2026-10-03 |
| [Cursor](https://thirdpartyindex.com/vendors/cursor.md) | Data querying; Read-only access to production logs and database for engineering support | USA | 2026-10-03 |
| [ElevenLabs](https://thirdpartyindex.com/vendors/elevenlabs.md) (AI model provider: ElevenLabs) | Audio processing; Speech-to-text for voice input | USA | 2026-10-03 |
| [Exa](https://thirdpartyindex.com/vendors/exa-labs.md) | Web scraping and search; Web search and content retrieval for AI-powered features | USA | 2026-10-03 |
| [Front](https://thirdpartyindex.com/vendors/front.md) | Customer support; Shared inbox for customer support conversations | USA | 2026-10-03 |
| [Google Analytics](https://thirdpartyindex.com/vendors/google-cloud.md) | Marketing analytics; Visitor analytics for the marketing website | USA | 2026-10-03 |
| [Google Cloud Platform](https://thirdpartyindex.com/vendors/google-cloud.md) | Cloud infrastructure and AI model hosting; Provider for backend support of AI-powered functionality | USA | 2026-10-03 |
| [Google Workspace](https://thirdpartyindex.com/vendors/google-cloud.md) | Company email and document collaboration; Email communications | USA | 2026-10-03 |
| Grain | Recording and transcription of customer calls; Video recording | USA | 2026-10-03 |
| [Heroku](https://thirdpartyindex.com/vendors/salesforce.md) | Application hosting; Hosts the Arrows application and backend services | USA | 2026-10-03 |
| [HubSpot](https://thirdpartyindex.com/vendors/hubspot.md) | CRM and email marketing; Customer relationship management and marketing email | USA | 2026-10-03 |
| [OpenAI](https://thirdpartyindex.com/vendors/openai.md) (AI model provider: OpenAI) | Large language models powering AI features; Provider for backend support of AI-powered functionality | USA | 2026-10-03 |
| [OpenRouter](https://thirdpartyindex.com/vendors/openrouter.md) (AI model provider: OpenRouter) | Backend support of AI-powered functionality; Routing layer for LLM API requests | USA | 2026-10-03 |
| [PlanetScale](https://thirdpartyindex.com/vendors/planetscale.md) | Application database; Primary application database | USA | 2026-10-03 |
| [Postmark](https://thirdpartyindex.com/vendors/postmark.md) | Application email service; Sends transactional and notification emails from the application | USA | 2026-10-03 |
| [Sentry](https://thirdpartyindex.com/vendors/sentry.md) | Application error tracking, metrics, and logging; Error tracking, performance monitoring, and application logs | USA | 2026-10-03 |
| [Slack](https://thirdpartyindex.com/vendors/slack.md) | Internal communication; Team communication, including shared channels with customers | USA | 2026-10-03 |
| [Stripe](https://thirdpartyindex.com/vendors/stripe.md) | Payment processing and invoicing; Subscription billing and payments | USA | 2026-10-03 |
| [WorkOS](https://thirdpartyindex.com/vendors/workos.md) | Authentication and single sign-on; Enterprise SSO and directory sync | USA | 2026-10-03 |

Read from ([evidence](https://thirdpartyindex.com/evidence/37062)). CSV: https://thirdpartyindex.com/vendors/arrows/subprocessors.csv

AI model providers (or a cloud provider's AI model service) among these entries: 4. All vendors that list one: https://thirdpartyindex.com/ai

## Compliance

As its trust center lists them.

- Audited: SOC 2 Type II ([evidence](https://thirdpartyindex.com/evidence/37061))
- Claimed: GDPR ([evidence](https://thirdpartyindex.com/evidence/37061))

## Subprocessor of (1)

Tracked vendors whose own subprocessor lists name it, and what they say they use it for.

- [OutboundSync](https://thirdpartyindex.com/vendors/outboundsync.md): Customer support

---

Third Party Index (https://thirdpartyindex.com) monitors vendors' public security and privacy documents and keeps each version as evidence. Data CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); vendors' own documents are theirs. API: https://thirdpartyindex.com/api