Third PartiesVersion: v1.0Updated: October 2026
Subprocessor Register
Complete verified register of cloud hosting, database, security, and AI model providers processing platform data.
Audience: Enterprise privacy evaluators and security compliance teams
Developer: Zambezi Digital
Official Policy Publication — Enforced Standards
This document is an active, binding operational policy published by Zambezi Digital governing the security, data privacy, and usage regulations of Kairo OS across all jurisdictions.
On this page
1. Verified Infrastructure Providers
• Supabase Inc. — Role: Primary Database, Auth & Object Storage | Locations: AWS Frankfurt (EU) & AWS US-East | Data: Account rosters, workspace files, audit logs.
• Cloudflare, Inc. — Role: Edge CDN, WAF, DDoS Protection, DNS | Locations: Global Edge Network | Data: IP addresses, encrypted HTTP traffic metadata.
• OpenAI, LLC — Role: LLM Completions & Embeddings | Locations: United States | Data: Ephemeral prompts and retrieved context (zero training on API tier).
• OpenRouter Inc. — Role: Multi-model AI Gateway & OCR Fallback | Locations: United States | Data: Ephemeral prompts and image OCR requests.
Key takeaway: Verified register: Supabase (DB/Auth), Cloudflare (Edge/WAF), OpenAI & OpenRouter (AI).
2. Contractual Commitments & Change Notice
All subprocessors are bound by written data processing agreements ensuring equivalent data protection safeguards. Customers receive at least 14 days advance written notice prior to onboarding new subprocessors.
Key takeaway: Strict subprocessor vetting and 14 days advance notice for changes.
Have questions about this policy?
Our legal and privacy desk is available for corporate inquiries.