Last updated: August 17, 2026
Sub-processors and data handling
This page names every company that touches data passing through Arsita, what each one receives, and where. It is written from the code that runs the product rather than from the list of accounts we hold, which is why some entries say a capability exists and has never been used.
If your procurement asks you to name our sub-processors in writing, send them this. Where we cannot offer something today, it is written here rather than left for you to discover during a review.
Who processes your data today
Cloudflare, Inc.
The platform. Everything runs here.
- Receives
- All of it. The application, the account database, your conversations, the raw payloads and transcripts in object storage, the queue that carries a turn, and the container your agent runs in. Two model calls are Cloudflare's own: uploaded PDFs and Word files are converted to text on Cloudflare's AI binding, and every message in and out is classified for content hazards by Llama Guard 3 on the same binding. That check stays inside Cloudflare rather than going to a fourth party.
- Where
- Cloudflare's network. We do not pin a region. Nothing in our infrastructure sets a Cloudflare jurisdiction or a location hint, so we cannot tell you which country a given account's conversations sit in, and we are not going to estimate.
- Why
- It is the platform. Removing it is not a setting.
DeepSeek
The model that writes every reply.
- Receives
-
The text of the conversation. Every role we offer for hire
runs on
deepseek-chat, so every reply your customers read was written there. Each turn carries the agent's instructions, the knowledge base you published, up to twenty turns of the conversation so far, up to six of that customer's earlier messages if they have written to you before, and the message they just sent. - Where
-
api.deepseek.com. DeepSeek is a Chinese company and there is no regional endpoint we could send you to instead. The request leaves from our own network, not from your agent's container: the key is never written into the container, and the call goes through a proxy we run, which is also where the cost of a turn is counted. - Why
- It answers.
Stripe
Payments, when you pay.
- Receives
- Your billing contact and the record of what you bought. Card details are entered on Stripe's own checkout page and never reach us, so there is no card number anywhere in our systems. No conversation content goes to Stripe.
- Where
- Stripe, a United States company.
- Why
- Taking money, and holding the card so we do not have to.
Anthropic, which nothing reaches today
Two Claude models are priced in our code and can be reached. Nothing we sell runs on them. Every role in the catalogue runs on DeepSeek, and DeepSeek is the model our credit is priced against, so it has no fallback to anything dearer. There is no ordinary path by which a conversation reaches Anthropic.
An admin can build a persona on Claude deliberately. If yours is one, Anthropic receives what DeepSeek receives above, and you will have been told before you hired it.
Channels you connect
Your agent answers where your customers already write to you. Today that list is: Website widget, Telegram, Webhook, WhatsApp, Instagram, Messenger, LINE, Slack, SMS, Google Chat, Zalo, Twitch, Matrix, Mattermost. Each of those is your account rather than ours, so the copy of a message that stays with the provider is governed by your agreement with them, not by ours.
Two of those names hide the company behind them. SMS is Twilio, and it is the one entry on the list where the vendor is not the name of the app. A webhook is not a provider at all: it is one address you point your own software at, so whoever is on the other end of it is you.
They are named here because procurement asks, not because we picked them for you. The website widget is the exception: it is ours and it runs on Cloudflare with everything else.
Built, and never used
Three vendors are implemented in the code and have never received a single request. They are listed because a sub-processor page that names only what we use is one you have no way to check.
- Brave Search. An agent's ability to search the web is written against Brave's API. The key it needs is not one our deployment binds at all, so no installation of this product can hold one. The tool is left out of the agent's list entirely rather than offered and failing, which means an agent will tell your customer it cannot look things up. No query has ever been sent.
- Lakera Guard. Prompt injection detection, implemented and selectable, with no key bound anywhere in our deployment because nobody has decided to buy it. The consequence is worth stating plainly: our guardrail classifies content hazards and does not catch prompt injection. That was measured against our own deployment rather than assumed.
- Resend. The sender for address verification and for telling you your agent handed a conversation back. Its key has never been set on any deployment, so this product has never sent an email. Two things you can check follow from that: no account has a verified email address, and choosing email as the destination for handover notices is refused when you try rather than stored and silently dropped.
Two we will not claim either way
Sentry collects error reports. Langfuse collects a trace of every model call, which means the prompt and the reply, which means the conversation. Both are in the code and both do nothing without a key: Sentry reports nothing, and Langfuse falls back to an observer that records nothing.
Whether a key is set is a fact about a deployment on a given day, and a web page is a bad place to keep one current. Ask us and you get the answer in writing with a date on it. If either is switched on for an account, it belongs in the list at the top of this page, and that is where it will go.
What we hold
- Your account. Name, email, a hashed password or the account you signed in with, sessions, and a two-factor secret if you turned that on.
- Your configuration. Your organization, your agents, and the channels you connected. Channel credentials are encrypted before they are written, under a key held on the application rather than in the database.
- Your knowledge base. Every published version of it, and the questions your agent could not answer from it.
- Conversations. Every message in and out, with who or what wrote it, and an audit record of what the agent did.
- Raw payloads and transcripts. What the channel provider actually delivered, kept in object storage so a disputed conversation is answerable months later.
- Money and usage. Credits, subscription state, and the token count and cost of each turn.
Where your conversations live
Each account gets its own database object, with its own storage inside it, addressed by your organization. It holds no key to anybody else's. That isolation is real and it is a boundary between clients rather than a boundary on a map.
So the honest answer to whether we can process in the EU is no, not today. Cloudflare offers a way to constrain where these objects live and we have not taken it, which means we cannot put a region in a contract and mean it. We also do not publish a data processing agreement.
If either of those is a condition of buying, say so. It is a piece of work with a date on it rather than something we would rather you did not ask about.
Retention
There is no retention period. That is not a polite way of saying it is long.
Nothing in the product expires a conversation, a message, a raw payload or a transcript. They stay until the account is erased. What does expire is short-lived and unrelated: invitations, half-finished authorisation flows, and sign-in sessions. A page quoting you thirty days or twelve months would be quoting a number that nothing in the system enforces. When something enforces one, this section changes.
Taking your data out, and erasing it
An export gives back everything you put in: every conversation, every message, and every version of your knowledge base. It reads in pages rather than stopping at a cap, so an export that ends is one that ran out of data.
Erasure is a single operation, so that closing an account and deleting an organization cannot mean two different things. It destroys the database object holding your conversations, destroys each container your agents ran in, deletes the object storage under your prefix, and only then deletes the rows. The rows go last because they are what name the other three.
What erasure cannot reach is anything a sub-processor already has. DeepSeek received the text of the turns it answered, and deleting our copy does not delete theirs. Stripe keeps the payment records it is required to keep. A message that arrived over WhatsApp is still in WhatsApp.
When this list changes
A vendor added here is a vendor that receives your data, so the change belongs to you before it happens rather than after. It is posted on this page with the date, and every client is told before it takes effect.
Told directly, and not by email, because this product has never been able to send one. That is the Resend entry above, and it is a gap we are closing rather than an arrangement we chose.
Contact
Questions about any of this, or a request for something in writing, go to hello@arsita.co. The wider policy is in the privacy policy.