Last updated: April 26, 2026
This page lists the sub-processors Tappy uses to operate the Service. See also /privacy and /security.
| Provider | Purpose | Location |
|---|---|---|
| Clerk | Authentication, session management, user directory. | United States |
| Anthropic | Claude models powering chat, analysis, narrative generation, code generation. | United States |
| OpenAI | Supplementary AI models for specific features. | United States |
| OpenRouter | Routing selected non-Anthropic AI model requests to model providers. | United States |
| Exa | Web search results used by AI features. | United States |
| Firecrawl | Structured web scraping for Web Sources. | United States |
| E2B | Isolated code-execution sandboxes. | United States |
| Stripe | Payment processing, subscription and billing management. | United States / Ireland |
| Railway | Application hosting and deployment. | United States |
| PlanetScale | Managed Postgres database for account and document storage. | United States |
| Upstash | Managed Redis for caching and rate limiting. | United States / European Union |
| PostHog | Optional product analytics after user consent. | European Union |
| Sentry | Error monitoring, diagnostics, and performance telemetry. | United States / European Union |
| Amazon Web Services (SES + S3) | Transactional and scheduled email delivery (SES); uploaded file and export storage (S3). | United States |
| OAuth access to Google Drive files and Google Sheets you select. | United States | |
| Microsoft | OAuth access to OneDrive files you select. | United States |
| HubSpot | OAuth access to HubSpot workspaces you connect. | United States |
We evaluate sub-processors for security and privacy posture before onboarding. We may add or replace sub-processors as the Service evolves. Material changes will be reflected on this page and, for customers with active DPAs, communicated in advance where required.
For a signed sub-processor list or a DPA, email privacy@tappy.sh.