Sub-processors
Every third party that can touch your data, what each one does, and where it operates.
Last updated
This list is short on purpose. The database, the mail server, the speech-to-text service and the WhatsApp gateway are all run by us on our own machines, so they are not sub-processors at all. Outgoing mail is the one exception to that sentence: our mail server hands it to Resend for delivery. What remains is the list below.
| Sub-processor | What it does | Data involved | Where |
|---|---|---|---|
| Cloudflare | CDN, DDoS protection, tunnel to our origin, Turnstile captcha, R2 object storage, and its own cookieless Web Analytics beacon on public pages | All traffic in transit; file attachments at rest in R2 | Global network, including EU and US |
| Resend | Delivers the email we send: sign-in and verification codes, invitations, notifications and invoices. Our own mail server relays outgoing mail through it, and it reports back whether each message was delivered, opened or clicked | Each outgoing message: the recipient's address, the subject and the body, and whether that message was delivered, opened or clicked | United States |
| The AI provider your traffic is routed to | Runs the model behind agent work, reached through our LLM gateway | The prompt content sent for each agent request, and its response | Depends on the provider; typically US or EU |
| The AI provider you chose (BYOK) | Only where your workspace supplies its own provider API key. Your prompts then go only to that provider, under your own account with them | The prompt content sent for each agent request, and its response | Wherever that provider operates |
| Only where a workspace connects a Google account, and only for that workspace's own data, through the connector you authorised | The data covered by the scopes you approved | Google's global infrastructure | |
| Google (Tag Manager and Analytics) | Website analytics on the public marketing pages only, loaded only after you consent. Never inside a workspace | Marketing page visits. No workspace content, ever | Google's global infrastructure |
| Microsoft (Clarity) | Session recordings and heatmaps on the public marketing pages only, loaded through Tag Manager and only after you consent. Never inside a workspace | Marketing page visits, and the pointer movement, scrolling and clicks of that visit. Typed input is masked. No workspace content, ever | Microsoft's global infrastructure |
Notes on the list
Cloudflare
Everything reaching UtilitySpaces passes through Cloudflare, which terminates TLS, absorbs attacks, and runs the Turnstile captcha that keeps our anonymous forms from being hammered. File attachments are stored in Cloudflare R2, an S3-compatible object store, with a local-disk fallback on our own servers; files are served through signed URLs that expire rather than from a public bucket, and each workspace has a storage quota.
AI providers
Agent work means sending part of your workspace content to a language model. By default that request goes through our own LLM gateway, which forwards it to a third-party provider. If you add your own provider API key instead, your prompts go only to the provider you picked, under your own agreement with them — which is the cleanest way to control exactly who sees your content. Stored keys are encrypted at rest and are never returned by any read path in the product, masked or otherwise.
Google connectors
Google appears here twice for two unrelated reasons. As a connector, it only ever touches data because somebody in your workspace deliberately authorised a Google account, and only within that workspace. As analytics, it only ever sees visits to our public marketing pages, after consent. The two never meet. The privacy policy has the full Google user data disclosure, including the Limited Use commitment.
What is not on this list
- No card data with us. Payment is by card through Creem (Armitage Labs OÜ), which acts as merchant of record for card payments: Creem takes the card details, charges it, and collects and remits sales tax. Card numbers never reach our infrastructure. What Creem receives is your email address, the plan you bought and the invoice number; see Creem' privacy policy and its buyer terms.
- No third-party transcription. Voice notes are transcribed by a Whisper service we run ourselves. Your audio does not leave our infrastructure.
- No third-party mailbox. Our mail server runs on this domain, operated by us, and mail sent to us is received there. Only outgoing mail is handed to Resend, above, for delivery.
- No advertising or data brokers. None, at any point, for any purpose.
Changes to this list
Before we add a sub-processor we will update this page and email workspace owners at least 30 days beforehand. If you object on reasonable data protection grounds within that window and we cannot offer a workable alternative, you may terminate the affected part of the service and we will refund the unused prepaid period. The process is set out in section 7 of the data processing addendum.
Questions about anyone on this list go to privacy@utilityspaces.com.