Subprocessors
Last updated October 2, 2026
Know exactly where your data is and how it’s used. These are the third parties Neotask uses or plans to use for the stated purposes. Production use remains subject to the applicable contractual, consent, and transfer safeguards described in our compliance records.
You’re in control. Vendors marked Connected by you receive your data only when you choose to connect that integration — for example, we never send anything to Slack, Telegram, or your Google account unless you link them yourself. Vendors marked Consent controlled receive advertising measurement data only after a separate visitor choice and while Neotask has enabled that service.
Infrastructure & Hosting
| Name | Purpose | Location | Website |
|---|
| Amazon Web Services (AWS) | Web hosting, object storage (S3), managed PostgreSQL databases (RDS), and service recovery emails through SES when enabled | United States | aws.amazon.com |
| Cloudflare | CDN, DNS, and security / DDoS protection for our websites | United States | cloudflare.com |
| MongoDB Atlas | Managed cloud database that stores your account records and product data | United States | mongodb.com |
| Heroku (Salesforce) | Application hosting + Redis caching and background job queue for the Neotask website and API | United States | heroku.com |
| Supabase | Object storage for files, generated assets, images, and website builds | United States | supabase.com |
| VercelConnected by you | Optional deployment and stable-link hosting of websites and presentation decks you explicitly publish | United States | vercel.com |
AI & Language Models
| Name | Purpose | Location | Website |
|---|
| Anthropic | Language models that power AI features | United States | anthropic.com |
| OpenAI | Language models, transcription, and image generation for AI features | United States | openai.com |
| Google (Gemini / Generative AI) | Language models and image generation for AI features | United States | ai.google.dev |
| xAI (Grok)Connected by you | First-party Grok language models, used when you select a Grok model (requests go directly to xAI under our platform key, or your own key if you bring one) | United States | x.ai |
| OpenRouterConnected by you | Optional model-routing aggregator that forwards AI requests to model providers | United States | openrouter.ai |
| AWS Bedrock (Amazon Web Services)Connected by you | BAA-covered, US-region hosted language models — the only AI provider that receives data on the HIPAA tier (transfer mechanism: US / EU-US Data Privacy Framework) | United States | aws.amazon.com |
| TypeSafe AI | Fast typed classification and ranking decisions that help AI agents triage email, route chat messages, choose tools, and prioritize tasks; disabled in HIPAA mode | United States | typesafe.ai |
| Other configurable model providersConnected by you | Additional language-model providers (e.g. MiniMax, Moonshot, Qwen, Together AI, Nvidia, Hugging Face), used only when you explicitly configure them | Varies by provider (some, e.g. MiniMax / Moonshot / Qwen, process in China) | openrouter.ai |
Voice & Speech
| Name | Purpose | Location | Website |
|---|
| Deepgram | Speech-to-text for the voice control feature | United States | deepgram.com |
| ElevenLabs | Text-to-speech voice for AI calls and voice features | United States / EU | elevenlabs.io |
Payments & Billing
| Name | Purpose | Location | Website |
|---|
| Stripe | Subscriptions, invoicing, payments, and chargeback/dispute handling. For companies you build through Neotask, Stripe Connect also powers "Neotask Payments" — your customers pay, Stripe handles identity verification and payouts to your own bank, and Neotask keeps a 15% platform fee. Where your AI agent spends on your behalf, Stripe also issues and authorizes the virtual payment cards that back that spend | United States | stripe.com |
Communication & Channels
| Name | Purpose | Location | Website |
|---|
| SlackConnected by you | Slack channel relay you connect | United States | slack.com |
| DiscordConnected by you | Discord channel relay you connect | United States | discord.com |
| TelegramConnected by you | Telegram channel relay you connect | Global | telegram.org |
| Microsoft Teams / Bot FrameworkConnected by you | Microsoft Teams channel relay you connect, including Bot Framework message delivery and Microsoft Graph/Entra directory/install flows | US / Global | microsoft.com |
| Google ChatConnected by you | Google Chat channel relay you connect | United States | workspace.google.com |
| X (Twitter)Connected by you | Social posting you connect | United States | x.com |
| TwilioConnected by you | SMS and voice telephony for calls and scheduling links | United States | twilio.com |
| AgentMail | Per-company email inboxes (send/receive) for AI agents | United States | agentmail.to |
Identity & Integrations
| Name | Purpose | Location | Website |
|---|
| Google WorkspaceConnected by you | Sign-in and the Google integrations you connect (Gmail, Calendar, Drive, Docs, Sheets) plus transactional email | United States | workspace.google.com |
| Apple (Sign in with Apple)Connected by you | Apple sign-in | United States | apple.com |
| GitHubConnected by you | Code and website repository hosting for projects you create | United States | github.com |
Push & Notifications
| Name | Purpose | Location | Website |
|---|
| Apple Push Notification service (APNs)Connected by you | iOS push notification delivery | United States | developer.apple.com |
| Expo PushConnected by you | Mobile push delivery for approval notifications (if you use the mobile app) | United States | expo.dev |
Analytics & Monitoring
| Name | Purpose | Location | Website |
|---|
| Google Analytics | Visitor analytics for our website and the websites the product generates for you; Google Ads measurement is used only when separately enabled and you consent to marketing and advertising cookies | United States | marketingplatform.google.com |
| Meta Platforms, Inc.Consent controlled | Optional Meta Pixel and Conversions API advertising measurement using consented _fbp/_fbc browser identifiers, safe public page origin/path, browser IP/User-Agent network metadata, pseudonymous event references, event type/time, and bounded conversion value/currency; off by default and disabled in HIPAA mode | United States / Global | facebook.com |
| Reddit, Inc.Consent controlled | Optional Reddit Pixel and Conversions API v3 advertising measurement using the consented _rdt_uuid browser identifier, safe public page origin/path, browser IP/User-Agent network metadata, pseudonymous event references, event type/time, and bounded conversion value/currency; off by default, disabled in HIPAA mode, and controlled by exact marketing consent plus GPC/DNT | United States / Global | reddit.com |
| DataFast | Privacy-minimized public-website analytics and campaign attribution; US measurement is default-on, EEA/UK/CH/unknown regions require analytics consent, and GPC/DNT disables it everywhere | United States | datafa.st |
| Sentry | Error monitoring to keep the product reliable | United States | sentry.io |
| ipwho.is (Geo-IP) | Approximate location (country/region) from an anonymized IP, for analytics | Varies | ipwho.is |
Customer Support
| Name | Purpose | Location | Website |
|---|
| Intercom | Customer support messaging | United States / EU | intercom.com |