# Gleap

Gleap (gleap.ai): subprocessors, data processing agreement, security documents and changes, as monitored by Third Party Index.

- Page: https://thirdpartyindex.com/vendors/gleap
- Documents last verified: 2026-10-04
- Transparency rating: 95/100 (how much it publishes, not how secure it is): Subprocessor list 30/30; Processing locations 8/8; Purposes 7/7; Data processing addendum 12/12; Trust center 8/8; Privacy policy 6/6; security.txt 6/6; Security page 5/5; Status page 5/5; Vulnerability disclosure 0/5 (not found); Pages still reachable 8/8
- Supply chain: relies on 14 tracked vendors directly, 115 within two hops, 323 within three; 1 tracked vendors rely on it directly, 2 within two hops, 2 within three
- Cite as: Gleap, Third Party Index, https://thirdpartyindex.com/vendors/gleap (data CC BY 4.0)

## Documents

| Document | URL | Last verified | Last changed |
|---|---|---|---|
| Trust center | https://www.gleap.ai/trust | 2026-10-04 | 2026-10-04 |
| Subprocessor list | https://www.gleap.ai/trust/subprocessors | 2026-10-04 | 2026-10-04 |
| Data processing addendum | https://www.gleap.ai/documents/GleapDataProcessingAddendum.pdf | 2026-10-04 | 2026-10-04 |
| Privacy policy | https://www.gleap.ai/legal/privacy-policy | 2026-10-04 | 2026-10-04 |
| Terms | https://www.gleap.ai/legal/terms-of-service | 2026-10-04 | 2026-10-04 |
| Security page | https://www.gleap.ai/trust/security | 2026-10-04 | 2026-10-04 |
| security.txt | https://www.gleap.ai/.well-known/security.txt | 2026-10-04 | 2026-10-04 |
| Status page | https://status.gleap.io/ | 2026-10-04 | 2026-10-04 |

## Subprocessors (19)

As its own list states them.

| Subprocessor | Purpose | Location | Listed since |
|---|---|---|---|
| [Anthropic Ireland, Limited](https://thirdpartyindex.com/vendors/anthropic.md) (AI model provider: Anthropic) | processing may take place in the US or EU; EU-only processing is not guaranteed. | Ireland | 2026-10-04 |
| [Cloudflare, Inc.](https://thirdpartyindex.com/vendors/cloudflare.md) | server locations: worldwide. File storage for screenshots and attachments uploaded through the Gleap widget and dashboard, kept separately for each region. Global delivery and video-call infrastructure may involve processing outside the selected region. | USA | 2026-10-04 |
| [DigitalOcean, LLC](https://thirdpartyindex.com/vendors/digitalocean.md) | regional hosting locations: Frankfurt, Germany (EU) and NYC3, New York (US), according to the selected region. Our main cloud provider: application servers, screenshot rendering, the production MongoDB database through DigitalOcean Managed Databases. | USA | 2026-10-04 |
| [Eleven Labs Inc. (ElevenLabs)](https://thirdpartyindex.com/vendors/elevenlabs.md) (AI model provider: ElevenLabs) | speech processing for the optional Kai Voice feature, including speech recognition and speech generation. Other provider processing and onward transfers are governed by the applicable provider agreement and transfer safeguards. | USA | 2026-10-04 |
| Endless Labs, Inc. (Datalab) | conversion of uploaded documents (PDFs, spreadsheets) to machine-readable text for AI processing. | USA | 2026-10-04 |
| [Firebase](https://thirdpartyindex.com/vendors/firebase.md) | push notification delivery. This feature must be manually activated. | Google Ireland Limited, Ireland | 2026-10-04 |
| FoundryLabs, Inc. (E2B) | isolated cloud sandboxes in which Kai Code works on repositories the customer has connected. | USA | 2026-10-04 |
| [Google Ireland Limited](https://thirdpartyindex.com/vendors/google-cloud.md) (AI model provider: Google Vertex AI / Gemini) | server locations: USA / EU. LLM processing through the Gemini API. | Ireland | 2026-10-04 |
| Hangzhou DeepSeek Artificial Intelligence Basic Technology Research Co., Ltd. | server location: China. Direct API used only as a fallback for DeepSeek models, which are primarily served via OpenRouter. | China | 2026-10-04 |
| [Mistral AI SAS](https://thirdpartyindex.com/vendors/mistral.md) (AI model provider: Mistral) | server location: EU. LLM processing for Mistral models. | France | 2026-10-04 |
| [MongoDB, Inc. (Voyage AI)](https://thirdpartyindex.com/vendors/mongodb.md) | Voyage AI embedding and reranking through MongoDB Atlas for knowledge-base content, tickets, and messages used in AI search and retrieval. Atlas is used for AI inference, not production database hosting. | USA | 2026-10-04 |
| [New Relic, Inc.](https://thirdpartyindex.com/vendors/new-relic.md) | server location: EU (Frankfurt, Germany). Application performance monitoring and logging for Gleap’s infrastructure; telemetry may include request metadata. | USA | 2026-10-04 |
| [OpenAI Ireland Ltd](https://thirdpartyindex.com/vendors/openai.md) (AI model provider: OpenAI) | OpenAI model serving through OpenAI’s default API endpoint for both regions; processing may take place outside the selected region. | Ireland | 2026-10-04 |
| [OpenRouter, Inc.](https://thirdpartyindex.com/vendors/openrouter.md) (AI model provider: OpenRouter) | LLM routing gateway used to access additional AI models (e.g., DeepSeek, Qwen, Kimi, MiniMax, GLM). Requests are forwarded to downstream model-hosting providers and may be processed in the EU, United States, or China. Selecting a model does not guarantee the downstream hosting provider or processing region. Gleap does not currently offer full control over these routes. | USA | 2026-10-04 |
| [Postmark](https://thirdpartyindex.com/vendors/postmark.md) | server location: USA. Transactional email delivery. | AC PM, LLC, USA | 2026-10-04 |
| [Sampark Inc. d/b/a Composio](https://thirdpartyindex.com/vendors/composio.md) | integration platform powering custom-agent tool connections (e.g., third-party app actions and triggers configured by the customer). | USA | 2026-10-04 |
| SideGuide Technologies, Inc. (Firecrawl) | crawling of customer websites for knowledge-base ingestion and web retrieval for Kai agents. | USA | 2026-10-04 |
| [SpaceXAI LLC (xAI/Grok)](https://thirdpartyindex.com/vendors/spacexai.md) (AI model provider: xAI) | Grok model serving. US accounts use xAI’s US endpoint. EU accounts use xAI’s default API endpoint, which can route requests to the United States. | USA | 2026-10-04 |
| TinyFish, Inc. | web search and page retrieval for Kai agents. | USA | 2026-10-04 |

Read from ([evidence](https://thirdpartyindex.com/evidence/40751)). CSV: https://thirdpartyindex.com/vendors/gleap/subprocessors.csv

AI model providers (or a cloud provider's AI model service) among these entries: 7. All vendors that list one: https://thirdpartyindex.com/ai

## Subprocessor of (1)

Tracked vendors whose own subprocessor lists name it, and what they say they use it for.

- [Signitic](https://thirdpartyindex.com/vendors/signitic.md): AI-based customer support and feedback platform

## Service status

Incidents it reported on its own status page.

- Last 1 days: 0 reported incidents (0 major or critical, 0 minor, 0 with no impact stated)
- Status page last read: 2026-10-04
- No incidents reported since Oct 4, 2026

## Security contact

From its security.txt (https://www.gleap.ai/.well-known/security.txt) ([evidence](https://thirdpartyindex.com/evidence/40746)):

- Contact: mailto:privacy@gleap.ai
- Disclosure policy: https://www.gleap.ai/trust
- Languages: en
- Valid until 2027-09-26

---

Third Party Index (https://thirdpartyindex.com) monitors vendors' public security and privacy documents and keeps each version as evidence. Data CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); vendors' own documents are theirs. API: https://thirdpartyindex.com/api