Subprocessors.

Cloud hosting and infrastructure: AI model inference, sign-in and identity, databases and file storage, email delivery, content delivery, compute, workflow orchestration, encryption key management, and infrastructure audit logging.

location

United States: us-east-1 for primary storage and application processing, and us-west-2 for encrypted disaster-recovery backups. Model inference may route to other AWS regions only if a Workspace Admin turns off the US-only setting, which is on by default.

notes

HIPAA-eligible under the AWS Business Associate Addendum. The us-west-2 backups are kept in a separate Zentrr-controlled AWS account. "Keep model calls in the United States" is a per-workspace setting (Settings → Policies); it is on for every workspace by default and stays on while a Business Associate Agreement is in force, and if a Workspace Admin turns it off, a model call that cannot be served in a US region may be served in an AWS region outside the United States.

Subscription billing, Checkout, and Customer Portal. Payment card data flows directly to Stripe; Zentrr does not store full card numbers.

location

United States

Marketing-site analytics and ad-conversion measurement.

location

United States / European Union

notes

Loaded only on the marketing site, and only when consent is granted via the cookie banner. Disabled in the authenticated application.

Foundation model provider (Claude models). Listed for transparency. For the default model lineup, not a direct Zentrr sub-processor — those Claude models are served entirely by Amazon Web Services, and Anthropic does not have access to customer prompts, completions, or logs.

location

United States (only for models an admin opts in to share data with Anthropic; otherwise n/a)

notes

Anthropic's Usage Policy and commercial terms are flowed down through our Acceptable Use Policy. Exception — models that share data with Anthropic: a small set of Anthropic models served through Amazon Web Services are offered only with provider data sharing turned on. These are OFF by default. If an org admin explicitly opts a specific agent into one, that agent's prompts and completions are shared with Anthropic and retained up to 30 days for trust & safety and abuse detection — never for model training. The opt-in is per agent and recorded in the org's audit log; all other agents and models keep the no-provider-access default.

Application error monitoring for the Zentrr web application, the Zentrr mobile app and the agent runtimes that run your agents, all reporting to one Sentry project (performance tracing on web and mobile only). Captures stack traces, request metadata, and diagnostic breadcrumbs.

location

United States

notes

What is removed before transmission, stated precisely rather than as "PII is scrubbed". Both apps strip authorization and cookie headers, the request body, URL query strings, and the user email and IP address — a crash is correlated by an opaque user id only — and cut breadcrumbs to a URL and status code. On web, email addresses and phone numbers are also removed from custom context, and a web address inside an error message loses its query string. Otherwise the text of an error message is not scrubbed, so a developer-authored error string could carry customer data; we treat that as a code-review obligation rather than claiming a filter that does not exist. In the agent runtimes, an agent error's stack trace and error-level log line are sent with no request addresses and no local variables, and the error text is not scrubbed.

Telephony for the voice channel: inbound and outbound call audio, caller and recipient phone numbers, and call metadata (duration, direction, disposition).

location

United States

notes

Applies only to organizations that enable the phone channel. Call audio is streamed in both directions in real time so an agent can answer the call; Zentrr stores call metadata and the transcript of every call. Numbers are provisioned under per-organization subaccounts of a Zentrr-held master account.

Mobile push notification delivery. Expo relays a notification to Google Firebase Cloud Messaging (Android) or Apple Push Notification service (iOS) for delivery to the device.

location

United States

notes

Applies only to users of the Zentrr mobile app who enable notifications. Unlike Web Push, an Expo payload is not end-to-end encrypted, so a notification title and body — which may name a message or a task — are readable in transit by Expo and by the platform relay. Turn notifications off in the mobile app if that is not acceptable for your content. This is separate from the Google entry above, which covers marketing-site analytics only.