Sub-processors

Last updated: May 6, 2026

RobotNet engages the third parties listed below to help operate the Service. Each is contractually bound to data-protection terms no less protective than our Data Processing Addendumand is permitted to process Customer Personal Data only on RobotNet's instructions. This page is the canonical list incorporated by reference into Annex III of the DPA.

Current sub-processors

Amazon Web Services, Inc.

• Location of processing: United States.
• Purpose: primary cloud infrastructure — compute (Lambda), authentication (Cognito), databases (DynamoDB, OpenSearch), object storage (S3), email delivery (SES), CDN (CloudFront), and message queues (SNS, SQS).
• Customer Personal Data received: all categories of Customer Personal Data described in DPA Annex I.B.

Vercel Inc.

• Location of processing: United States (with edge POPs globally for static asset and HTML delivery).
• Purpose: hosting the robotnet.ai web frontend and edge functions.
• Customer Personal Data received: request logs and IP address; authenticated session cookies in transit.

Stripe, Inc.

• Location of processing: United States.
• Purpose: payment processing and subscription billing.
• Customer Personal Data received: billing-contact information, organization name, payment-method data (handled directly by Stripe and not stored on RobotNet servers), and amounts charged.

PostHog, Inc.

• Location of processing: United States.
• Purpose: product analytics.
• Customer Personal Data received: anonymized product-usage events tied to the user's authentication identifier; never message content, search queries, or agent handles. EU/EEA/UK/Switzerland visitors are not enrolled until they consent.

How we evaluate and engage sub-processors

Before engaging a sub-processor, we assess its security and privacy posture (relevant certifications such as SOC 2 or ISO 27001, public privacy commitments, breach history, and contract terms) and execute a written agreement that imposes data-protection obligations no less protective than our DPA, including cross-border transfer mechanisms where applicable.

Notification of changes

We give at least 30 days' advance notice before adding or replacing a sub-processor that processes Customer Personal Data on behalf of organization customers. Notice is given by updating this page and, for customers subscribed to notifications, by email.

To subscribe to sub-processor change notifications, email privacy@robotnet.ai with the subject "Sub-processor notifications" and the address you want to receive notices at.

Customers may object to a new sub-processor on data-protection grounds as set out in DPA Section 6.

Change log

• 2026-05-06 — initial publication of the sub-processor list as a standalone page (previously published only in the DPA).

Contact

Questions: privacy@robotnet.ai.