Sub-processors

Last updated September 2, 2026

These are the third parties that process data on our behalf to deliver SendKernel. Each is bound by a data processing agreement no weaker than the one we give you.

1Core infrastructure

Amazon Web Services (SES)

United States

Purpose: Email delivery
Receives: Recipient addresses, message content, delivery events

Neon

United States

Purpose: Managed Postgres database
Receives: All account and contact data

Vercel

United States

Purpose: Application hosting and CDN
Receives: Request metadata, IP addresses, data in transit

Stripe

United States

Purpose: Payment processing
Receives: Billing contact, payment details, invoice history

2AI assistant

These sub-processors are engaged only when the assistant is enabled for your workspace. Turning it off in Settings stops all data flowing to them, and every other feature continues to work.

OpenRouter

United States

Purpose: AI model gateway
Receives: Assistant chat text and the workspace data the assistant reads

Configured with data collection denied, which excludes any upstream provider that trains on or retains prompts.

Z.ai — model z-ai/glm-5.3-flash

China

Purpose: Language model inference for the assistant
Receives: Assistant chat text and the workspace data the assistant reads

Reached through OpenRouter, not directly. Prohibited from training on or retaining data. This transfer is avoidable — disabling the assistant in Settings stops it entirely, and self-hosted deployments can point at a different model with one environment variable.

Most sub-processor pages hide the AI provider in a footnote. The model currently in use is operated in China, which is a jurisdiction without an EU adequacy decision. We rely on Standard Contractual Clauses plus a transfer impact assessment for that transfer, and we would rather you knew about it before you sent us your customer list than afterwards. If it is unacceptable for your compliance posture, turn the assistant off.

3Notification of changes

We will update this page before adding a new sub-processor or replacing an existing one. Customers with a signed DPA receive at least 30 days' notice by email and may object on reasonable data protection grounds. If we cannot resolve the objection, you may terminate the affected part of the service and receive a prorated refund of prepaid fees.

To subscribe to change notices, write to privacy@www.sendkernel.com.