# Plug and AI

Plug and AI (plugand.ai): subprocessors, data processing agreement, security documents and changes, as monitored by Third Party Index.

- Page: https://thirdpartyindex.com/vendors/plug-and-ai
- Documents last verified: 2026-09-30
- Transparency rating: 71/100 (how much it publishes, not how secure it is)
- Cite as: Plug and AI, Third Party Index, https://thirdpartyindex.com/vendors/plug-and-ai (data CC BY 4.0)

## Documents

| Document | URL | Last verified | Last changed |
|---|---|---|---|
| Subprocessor list | https://plugand.ai/dpa.html#subprocessors | 2026-09-30 | 2026-09-30 |
| Data processing addendum | https://plugand.ai/dpa.html | 2026-09-30 | 2026-09-30 |
| Privacy policy | https://plugand.ai/privacy.html | 2026-09-30 | 2026-09-30 |
| Terms | https://plugand.ai/terms.html | 2026-09-30 | 2026-09-30 |

## Subprocessors (7)

As its own list states them.

| Subprocessor | Purpose | Location | Listed since |
|---|---|---|---|
| AI model providers reached through OpenRouter | Generating the response to a visitor's message | Varies by provider | 2026-09-30 |
| [Cloudflare, Inc.](https://thirdpartyindex.com/vendors/cloudflare.md) | CDN, bot protection (Turnstile), and the D1 database holding embed; configuration and usage records | Global edge; database primary in the EU | 2026-09-30 |
| [Mailgun (Sinch)](https://thirdpartyindex.com/vendors/mailgun.md) | Transactional email (sign-in links, service notifications) — used only; if a visitor chooses to sign in with an email address | EU / USA | 2026-09-30 |
| [OpenRouter, Inc.](https://thirdpartyindex.com/vendors/openrouter.md) | Gateway to AI model providers — message content is transmitted here; and routed onward to the selected model provider | USA | 2026-09-30 |
| [Salesforce, Inc. (Heroku)](https://thirdpartyindex.com/vendors/salesforce.md) | Application hosting | USA | 2026-09-30 |
| [Stripe, Inc.](https://thirdpartyindex.com/vendors/stripe.md) | Payment processing for the account paying for the widget (billing; data only — never visitor conversation content) | USA / EU | 2026-09-30 |
| TypeSafe (Jev model) | Classifying what a message is asking for, so the service can offer the; email addresses or account identifiers. Not used where Zero Data Retention is enabled.; in the conversation and one boolean flag; never the assistant's replies, attachments,; plai.chat only — not the Slack or Microsoft Teams apps; right tools and models. Receives the text of up to the three most recent user messages | USA | 2026-09-30 |

Read from ([evidence](https://thirdpartyindex.com/evidence/24991)). CSV: https://thirdpartyindex.com/vendors/plug-and-ai/subprocessors.csv

## Listed as a subprocessor by (0)

No tracked vendor lists it.

---

Third Party Index (https://thirdpartyindex.com) monitors vendors' public security and privacy documents and keeps each version as evidence. Data CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); vendors' own documents are theirs. API: https://thirdpartyindex.com/api