Sub-processor List
Last updated: April 17, 2026
Thalian engages the following third-party sub-processors to deliver the Thalian service. All sub-processors are bound by data processing agreements no less protective than Thalian's DPA, and are required to implement appropriate technical and organizational security measures.
Thalian will notify customers of any intended addition or replacement of sub-processors with at least 14 days' notice, providing the opportunity to object as described in
Section 5 of the DPA.
Infrastructure & Platform
| Vendor |
Purpose |
Data Processed |
Location |
Privacy Policy |
| Supabase |
Database, authentication, and row-level storage |
User accounts, workspace configurations, integration credentials (encrypted), findings, audit logs |
US (AWS us-east-1) |
supabase.com/privacy |
| Cloudflare |
Hosting, CDN, and edge compute (Workers / Pages) |
IP addresses and request metadata in transit; customer data at rest remains US-only |
Global edge (data at rest: US) |
cloudflare.com/privacypolicy |
AI & Intelligence
| Vendor |
Purpose |
Data Processed |
Location |
Privacy Policy |
| Anthropic |
AI inference (Claude API) for the Thalian AI assistant |
Chat messages and analysis queries submitted by users; not used for model training |
US |
anthropic.com/privacy |
Payments & Billing
| Vendor |
Purpose |
Data Processed |
Location |
Privacy Policy |
| Stripe |
Payment processing and subscription billing |
Payment method details, billing email, company name, billing address |
US |
stripe.com/privacy |
Communications
| Vendor |
Purpose |
Data Processed |
Location |
Privacy Policy |
| Loops |
Transactional and lifecycle email delivery |
Email address, first name, workspace name, subscription plan |
US |
loops.so/privacy |
| Plain |
In-app customer support chat |
Name, email address, support conversation content |
US |
plain.com/legal/privacy-policy |
Observability
| Vendor |
Purpose |
Data Processed |
Location |
Privacy Policy |
| Sentry |
Application error monitoring and performance tracing |
Error messages and stack traces; PII scrubbed before transmission; 10% trace sampling rate |
US |
sentry.io/privacy |
For questions about this list or to request additional information about any sub-processor's security and compliance posture, contact privacy@thalian.ai.
← Back to home