Sub-processors
This page lists the providers that Minimal uses directly to operate the product and process Personal Data on behalf of customers. Last reviewed: 31 August 2026.
Minimal-managed providers
These providers are used by Minimal for infrastructure, application hosting, authentication, billing, AI processing, retrieval, observability, and public website operations.
The location column distinguishes configured EU data regions from international transfer exposure. A provider may store or execute customer workloads in an EU region while its legal entity, global network, support, control plane, or sub-processors operate outside the EEA. Any such transfer remains subject to our DPA and applicable transfer safeguards.
Customer Data is not sent to direct OpenAI or Anthropic APIs. Supported model processing is contracted through EU-configured Amazon Bedrock, Microsoft Azure OpenAI Service, and Google Cloud Vertex AI where used. AWS states that Bedrock model providers cannot access customer prompts or completions. Pinecone is no longer used as a production sub-processor. See the Amazon Bedrock data-protection documentation.
| Provider | Scope | Location | Purpose | Data Categories | Date Added |
|---|---|---|---|---|---|
| Amazon Web Services (AWS) | Infrastructure and EU-hosted Bedrock AI processing | European Union (EU regions) | Cloud infrastructure, SQS queues, compute, encryption, secrets, object storage, security services, and Amazon Bedrock model processing in EU regions where configured. | Customer data, application data, encrypted credentials, queue payloads, operational logs. | 2024-10-01 |
| Vercel | Application hosting and edge delivery | United States / global network; EU function and storage regions where configured | Dashboard hosting, deployment, edge delivery, firewalling, serverless functions, and file storage. Functions and storage are configured in EU regions where supported; Vercel's CDN, security network, control plane, support, and failover may process data globally. | Account data, application data, uploaded files, request metadata, operational logs. | 2024-10-01 |
| Neon | Database hosting | European Union | PostgreSQL database hosting for application state, configuration, and support automation records. | Customer data, account data, application data, configuration records. | 2024-10-01 |
| Clerk | Platform authentication only | United States | Authentication, organization membership, user sessions, and platform account access control. Clerk is not used for customer-support conversations, tickets, or knowledge content. | Platform-user identifiers, email addresses, organization membership, session data, and authentication, IP, device, and request metadata. | 2026-05-11 |
| Stripe | Billing | United States / Ireland | Billing, subscription management, invoices, tax handling, and payment processing. | Billing contact data, payment metadata, subscription data, invoice data. | 2026-05-11 |
| Loops | Platform-user email and lifecycle communications | United States / international processing | Platform account contact management, transactional email, product communications, and subscription preferences. | Platform-user names, email addresses, user identifiers, roles, mailing-list preferences, and email engagement metadata. | 2026-08-31 |
| Mailgun | EU-hosted transactional email | European Union (EU region) | Transactional platform email and support-escalation delivery through Mailgun's EU API region. | Recipient names and email addresses, email subject and body content, attachments where enabled, and delivery metadata. | 2026-08-31 |
| Slack | Internal operational notifications | United States / global processing | Internal notifications for platform sign-ups, customer-success operations, billing, retention, and service health. | Platform-user names and email addresses, organization identifiers, account roles, operational alerts, and limited diagnostic metadata. | 2026-08-31 |
| Microsoft Azure OpenAI Service | EU-hosted AI processing | European Union (EU Azure resources) | Azure-hosted model processing for customer support workflows, classification, summarization, generation, embeddings, and evaluation where configured. | Customer queries, support conversation context, knowledge snippets, embeddings input, analytics evaluation data. | 2026-05-11 |
| Google Cloud Vertex AI / Gemini | EU-hosted AI processing | European Union (EU multi-region) | Google-hosted model processing, summarization, classification, and embeddings through an EU-restricted endpoint configuration. | Customer queries, support conversation context, source text, embeddings input data. | 2026-05-11 |
| Google Tag Manager / Google Analytics | Optional analytics and marketing tags | United States / global Google infrastructure | Consent-gated website analytics, conversion measurement, and marketing tag delivery. | Cookie identifiers, consent state, page visit events, device and browser metadata. | 2026-05-18 |
| Render | Legacy service hosting | European Union | Legacy webhook and integration service hosting for selected endpoints. | Application data, webhook payload metadata, operational logs. | 2024-10-01 |
| Sentry (Functional Software, Inc.) | EU-hosted observability | Germany (EU data region) | Error monitoring, logging, tracing, and operational diagnostics. Production event ingestion and storage are configured for Sentry's Germany region. | Application logs, error metadata, trace metadata, operational identifiers, and request metadata after configured redaction. | 2026-05-11 |
| Cloudflare Turnstile | Security and bot detection | United States / global Cloudflare infrastructure | Invisible bot detection and automated-abuse prevention for protected storefront operations. | IP address, TLS fingerprint, user-agent header, sitekey, associated origin, and verification metadata. | 2026-08-17 |
| Oxylabs | Proxy network for helpdesk API access | European Union provider / global proxy network | Proxy routing for selected helpdesk and integration API requests that require managed egress. | Target URLs, network and request metadata, and data transmitted through proxied helpdesk requests. | 2026-08-31 |
| Decodo | Public website scraping proxy | European Union provider / global proxy network | Proxy routing used only for self-hosted crawling of public websites. Decodo is not used for platform authentication, customer support traffic, or helpdesk API access. | Public target URLs and public website responses, plus request, response, IP, and network metadata. Customer conversations, account records, and uploaded files are not intentionally sent. | 2026-08-31 |
| Firecrawl Cloud | Hosted web crawling and content extraction | United States | Hosted fallback crawling, webpage extraction, mapping, and search for customer-selected public web sources. | Target URLs, public webpage content, crawl instructions, and request and response metadata. | 2026-08-31 |
| LangSmith | AI workflow observability | European Union (EU endpoint) | AI workflow tracing, evaluation, debugging, and model run diagnostics. | Prompt metadata, trace metadata, sanitized conversation context, model usage data. | 2026-05-11 |
| Langfuse | AI workflow observability | European Union (EU Cloud region) | AI workflow tracing, evaluation, debugging, and model run diagnostics. | Prompt metadata, trace metadata, sanitized conversation context, model usage data. | 2026-05-11 |
31 August 2026 review
Direct OpenAI, direct Anthropic, and Pinecone were removed from the production sub-processor list. The review also clarified Vercel's global network and transfer exposure, Clerk's authentication-only scope, and Sentry's Germany data region. Mailgun, Loops, Slack, Oxylabs, Decodo, and Firecrawl Cloud were added to reflect the current production configuration.
Customer-enabled integrations
Customers may connect their own help desk, inbox, commerce, marketplace, shipping, returns, warehouse, subscription, delivery, or custom API systems. Those connected systems are controlled by the customer and are not Minimal-managed sub-processors unless Minimal separately contracts with the provider for the relevant service.
Updates and Notifications
We will notify all customers of changes to our sub-processors list. Customers have the right to object to new sub-processors within 10 business days of notification.