Sub-processors
Last updated: October 23, 2026
This live list covers third parties that process Customer Personal Data to deliver Zentrik’s services. This page is informational. Contractual commitments are in the Order Form, Terms, and any executed DPA.
Notice and changes
We notify customers of intended additions or replacements by email or in-product notice. The change is effective upon notice. Customers may object on reasonable, documented privacy or security grounds within 10 days. In urgent cases required for security, continuity, or bug fixes, we may engage a Sub-processor immediately and will provide notice without undue delay.
Security: security@zentrik.ai | Privacy: privacy@zentrik.ai
Current Sub-processors
Where applicable, standard transfer terms are available as part of an executed DPA.
| Sub-processor | Purpose | Data handled | Region |
|---|---|---|---|
| Fly.io, Inc. | Application hosting and managed Postgres | All Workspace Data | mad (EU), sjc (US) |
| Amazon Web Services, Inc. (S3) | Object storage | Uploaded files, text extracted from them, imported source text (for example support tickets and transcripts), and generated documents | us-east-2 (US) |
| Sentry.io, Inc. | Error monitoring and performance diagnostics | Error metadata and operational diagnostics | United States |
| Google LLC (OAuth, reCAPTCHA, Gmail SMTP) | Authentication, bot protection, email delivery | Security and device telemetry, SSO assertions, email metadata/content | United States |
| AC PM LLC (Postmark) | Delivery of account, product, and update email, with delivery and suppression event processing | Recipient and sender addresses, message content, and delivery, bounce, complaint, and subscription-change events | United States |
| OpenAI, L.L.C. | AI text generation and processing (API) | Prompt text and contextual project content supplied by Customer | United States (provider-dependent) |
| PostHog, Inc. | Optional browser product analytics, masked session recordings where permitted, and bounded service telemetry | IP address, device/OS, browser, timestamps, bounded event and operational metadata, opaque user and workspace identifiers, and display names for named product Users; browser analytics is configured not to include email addresses or Workspace Data | United States |
| Slack Technologies, LLC | Support communications | Names, contact details, and support interaction content | United States |
Analytics and connected tools
Our Privacy Policy describes analytics data, masked session recordings, regional recording defaults, and workspace restrictions. Contact privacy@zentrik.ai for workspace requirements.
Customer-enabled integrations, such as Jira and v0, are controlled by the customer and are not Zentrik Sub-processors by default. Prototype tools receive the specification the customer sends, using the customer’s account and API key.
Change management and remedies
If a customer objects and the parties cannot resolve the objection, the customer may suspend the affected processing or terminate the impacted services, and Zentrik will provide a pro-rata refund of prepaid fees for the terminated portion.
Change history
- October 23, 2026: Clarified display-name processing for named product Users to match the Privacy Policy; consolidated transfer terms. No providers were added or removed.
- October 4, 2026: Removed Anthropic and the optional Gemini path, which no product feature uses; described what AWS S3 stores; named prototype tools as customer-enabled integrations.
- September 21, 2026: Updated regional recording defaults and centrally managed workspace restrictions.
- September 9, 2026: Added workspace analytics restrictions and conditions for masked session recordings.
- August 25, 2026: Removed Google Analytics and limited browser product analytics to bounded PostHog events with region-appropriate privacy controls.
- July 25, 2026: Confirmed infrastructure, monitoring, analytics, support, and optional AI processing providers.
- February 16, 2026: Updated analytics data-handling detail for authenticated users.
- February 5, 2026: Updated notice, transfer, and retention language to align with the DPA.
Questions
For privacy or security questions, contact privacy@zentrik.ai or security@zentrik.ai.
Company legal contact
Zentrik Company
490 Post St, Ste 500, PMB 2017
San Francisco, CA 94102, USA
Legal: legal@zentrik.ai | Privacy: privacy@zentrik.ai | Security: security@zentrik.ai