Legal
Subprocessors
Services that process customer data on our behalf to run Solvaro. Last updated October 28, 2026.
Always used
| Vendor | Purpose | Data it receives | Location |
|---|---|---|---|
| Railway Corporation | API hosting, PostgreSQL database, Redis cache | All customer data Solvaro stores: account, org settings, encrypted connector credentials, cases, notes, transcripts, Case Memory, audit log. Encrypted at rest with AES-256, including volumes and backups | United States (US West) |
| Cloudflare, Inc. | Marketing website and docs hosting (Pages, free plan) | Website visitor requests (IP address, browser details). No product data | United States / global CDN |
| Deepgram, Inc. | Speech-to-text for live call transcripts | Call audio while a call is transcribed (only if you use calls) | United States |
| Duck Duck Go, Inc. | Public web search used during investigations | Search queries Solvaro builds from an investigation (may include error messages or product names from a ticket). No account data | United States |
| Stripe, Inc. | Payments and billing | Billing contact, plan and payment details (card data handled by Stripe only) | United States |
AI model providers: only the one you select
Each org picks its AI provider in settings. Only the selected provider receives your org’s AI requests (ticket text, logs, code snippets, transcripts and screenshots sent with each request), and only it is your subprocessor. Solvaro enforces this in code. Solvaro does not use your data to train models unless your admin opts in.
| Provider | Country | Status | Training and retention |
|---|---|---|---|
| Anthropic, PBC (Claude) | United States | If selected | API data not used for training by default; zero data retention available for eligible accounts, otherwise limited retention for abuse monitoring |
| OpenAI, L.L.C. (GPT) | United States | If selected | API data not used for training by default; retained up to 30 days for abuse monitoring unless zero data retention is approved |
| X.AI Corp. (Grok) | United States | If selected | API data not used for training without permission; retained up to 30 days unless zero data retention is enabled; DPA at x.ai/legal/data-processing-addendum |
| Google LLC (Gemini) | United States | If selected | Paid API data not used to improve products; limited retention for abuse monitoring |
| Hangzhou DeepSeek AI (DeepSeek) | China(China-based) | Opt-in only | Processed and stored in the People’s Republic of China. DeepSeek’s API terms do not say API data is excluded from training. No EU adequacy decision for China. Enable only after admin opt-in |
| Moonshot AI (Kimi) | China (data stored in Singapore)(China-based) | Opt-in only | China-based company. Solvaro uses the international platform (api.moonshot.ai), whose privacy policy says data is stored in Singapore and API data is not used for training. Enable only after admin opt-in |
China-based providers are off by default. An org admin must opt in explicitly, and the opt-in is recorded in the audit log. Orgs that have not opted in never have data routed to China, including as a fallback.
Bring your own key: if you connect your own provider key, that provider processes your data under your own contract with it, and it is not an Solvaro subprocessor for that traffic.
Sign-in and connectors you choose
Google and GitHub sign-in, and connectors you add (Zendesk, ServiceNow, Jira, Slack, Intercom, Freshdesk, Salesforce, Zoom, calendars, PagerDuty, Datadog, Sentry, Confluence, Notion), are your own accounts used with the permissions you grant. They are not Solvaro subprocessors.
Changes
We give at least 30 days’ notice before a new subprocessor starts processing customer data, and you may object. To get notified, email daarishlomo@gmail.com. See also the data processing addendum, privacy policy and security.