Sub-processors
Last Updated: September 1, 2026
These are the third parties KRTR, Inc. engages to operate the KRTR.ai platform, what each one receives, and where it processes. Section 6.1 of our Privacy Policy describes the categories; this page names the providers.
Each is bound by a written data-protection agreement, is limited to providing the service it provides for us, may not sell or reuse your data, and owes confidentiality obligations no less protective than our own. AI model providers are additionally held to the standard in Section 5.2 of the Privacy Policy, which requires enterprise terms restricting the use of customer data to train their models, and a recognised independent security certification.
A change to this list is not a change to our Privacy Policy and reduces no commitment in it. Firms and investors with a Data Terms agreement receive advance notice of a new sub-processor and may object; see Section 7.3 of those Terms.
Infrastructure
| Provider | Purpose | What it receives | Location |
|---|---|---|---|
| Google Cloud / Firebase | Cloud infrastructure, authentication, database and file storage | Account data, uploaded material, and all stored platform data | United States |
| Vercel | Application hosting and content delivery | Request and log data | United States |
| Upstash | Caching and background job queueing | Transient operational data and identifiers | United States / global edge |
AI model processing
| Provider | Purpose | What it receives | Location |
|---|---|---|---|
| Google Cloud Vertex AI | AI model processing. Includes partner and third-party publisher models served inside Google Cloud as a managed service and governed by Google Cloud's terms | Material submitted for analysis | United States regional and global endpoints |
| OpenAI | AI model processing for internal, staff-operated tooling only Not part of the customer-facing analysis pipeline. Reached only through admin-restricted internal tools. | Material processed by KRTR staff during support and investigation | United States |
Communications
| Provider | Purpose | What it receives | Location |
|---|---|---|---|
| SendGrid (Twilio) | Outbound transactional and notification email, and inbound email processing | Recipient address and message content for outbound mail; the full contents and attachments of email sent to a KRTR-hosted deal address for inbound | United States |
| Slack | Internal operational alerts to our own team | Deal and company identifiers in internal notifications | United States |
Payments
| Provider | Purpose | What it receives | Location |
|---|---|---|---|
| Stripe | Payment processing | Billing details, handled by Stripe and not stored by us | United States |
Analytics and monitoring
| Provider | Purpose | What it receives | Location |
|---|---|---|---|
| PostHog | Product analytics Only where you have accepted analytics cookies. Configured with autocapture off, IP capture off and session replay off. | Usage events — identifiers, durations and dimensions. Never the content of your documents, notes or assessments | European Union (Frankfurt) |
| Vercel Analytics | Anonymous pageview counts on public marketing pages | Anonymous pageview data. No tracking cookies, no personal identifiers | United States |
| Sentry | Error monitoring and performance diagnostics Error capture runs always, as it is necessary to operate and secure the platform. Session recording runs only where you have accepted analytics cookies, with text masked and media blocked. | Error reports, stack traces, request paths, recent-action trails and diagnostic logs. Share tokens are stripped from URLs before transmission | United States |
Research and enrichment
Your uploaded documents are not transmitted to these providers. What they receive is the search query — typically a company name, founder or team member names, a website domain, an industry, and a short research question. The exception is URL extraction: a link you provide is fetched by the provider, so do not paste a link to material you would not want them to retrieve.
| Provider | Purpose | What it receives | Location |
|---|---|---|---|
| Serper | Web search for research features | Search queries generated from the material being analysed | United States |
| Exa | Web search and URL content extraction for research features | Search queries, and any URL you provide for extraction — which Exa then fetches itself | United States |
| Tavily | Web search and URL content extraction for research features | Search queries, and any URL you provide for extraction — which Tavily then fetches itself | United States |
| PubMed, USPTO | Public research and patent databases | Search terms only | United States |
| LinkdAPI, RapidAPI | Professional profile lookup for team analysis | Names and profile identifiers of people named in materials being analysed | United States |
Systems you connect yourself
These process nothing unless you connect them. We read only — we never create, modify, delete or send anything in a system you connect.
| Provider | Purpose | What it receives | Location |
|---|---|---|---|
| Close, Affinity, Airtable | Customer relationship and pipeline systems you connect Only where you authorise the connection. Revocable by you at any time. | Read-only access to the records your authorisation covers | United States |
| Flock | A messaging system you connect, read as deal signal Only where you authorise the connection. Revocable by you at any time. | Read access to the messages your authorisation covers | United States |
International transfers
Where a provider processes outside the EEA or UK, we rely on the European Commission's Standard Contractual Clauses for EEA transfers and the UK International Data Transfer Addendum for UK transfers, incorporated into that provider's data processing agreement, together with any certification the provider holds under the EU–US Data Privacy Framework. You may request a copy of the relevant safeguards at privacy@krtr.ai.
Questions
Write to privacy@krtr.ai. Firms and investors may also request a data processing agreement and a copy of our transfer safeguards.