Kapso engages the following providers to process customer personal data in providing, securing, and supporting the Services. Providers listed for a particular feature apply only when that feature or route is used. Listing a provider does not mean every customer’s data is sent to it.
Shared infrastructure and service operations
| Provider | Processing purpose and scope | Typical processing location |
|---|---|---|
| Kapso SpA | Affiliated engineering, operations, and support; access to customer data only as needed for those activities. | Chile; remote access to US-hosted systems |
| Render Services, Inc. | Application hosting, workers, compute, and managed Redis; application records, customer content, operational data, and service credentials. | United States |
| PlanetScale, Inc. | Managed PostgreSQL; customer content, project configuration, application records, and associated identifiers. | United States |
| Cloudflare, Inc. | Object storage, edge functions, delivery, and security; media, files, configured function inputs/results, requests, and technical metadata. | United States and global network locations |
| Elasticsearch B.V. / Elastic | Customer-facing log storage/search and operational diagnostics; configured request/response logs, message/webhook events, execution events, and associated identifiers/content. | United States or configured Elastic Cloud location |
| Functional Software, Inc. (Sentry) | Error diagnostics; filtered exception, request, breadcrumb, and technical context, including customer identifiers or content where present in an error. | United States |
| Better Stack, Inc. | Uptime monitoring, status pages, and incident telemetry; service availability, incident metadata, and limited request data. | United States and provider locations |
| Datadog, Inc. | Infrastructure and application monitoring; metrics, traces, logs, and associated identifiers where collected. | United States |
| Plus Five Five, Inc. (Resend) | Service email delivery, including workflow/agent failure and service notifications; recipients, notification content, execution/error details where included, and delivery metadata. | United States |
| PostHog, Inc. | Product diagnostics and selected interaction recordings; events, technical metadata, and associated project/message/conversation identifiers where included. Inbox replay masking applies, but does not eliminate every identifier from event processing. | United States |
| Slack Technologies Limited / Slack Technologies, LLC and applicable affiliates | Support and incident collaboration where customer personal data is included; relevant case descriptions, service identifiers, diagnostic excerpts, and investigation messages. This entry concerns Kapso’s workspace. | United States; provider access and processing locations may vary |
| Supabase Pte. Ltd. | Support-case storage, support automation, and search; case records, ticket threads, investigation artifacts, service identifiers, and search queries where they include customer personal data. | United States (Ohio primary databases); other provider locations where applicable |
| Vercel Inc. | Hosting and server-side operation of Kapso’s support application; support-case data handled by the application and associated technical metadata. | United States (Washington, DC configured function region); global delivery network |
Support entries concern customer data handled to investigate and resolve service issues. Ordinary account, sales, or relationship correspondence alone does not establish a subprocessor role.
Providers for selected features and routes
| Provider | When applicable | Processing purpose and scope | Typical processing location |
|---|---|---|---|
| Google LLC / Google Cloud | Google AI/live-assistance features and Google-hosted agent messaging/infrastructure routes | Gemini inference and live assistance, including microphone audio, shared screen images, prompts, and outputs; Pub/Sub invocation/results and technical metadata for routes that use it. | United States and other configured provider locations |
| E2B, Inc. | Sandbox/code-execution features | Commands, files, execution inputs/results, and temporary execution credentials. | United States |
| Pipedream, Inc. | Connected-app authentication and actions through Kapso’s Pipedream Connect project | Connected-account credentials and metadata, user/project identifiers, configured action inputs/results. Customer ownership of the connected application does not remove Pipedream’s role in Kapso’s own Connect service. | United States |
| OpenAI, L.L.C. | Relevant AI model/features through Kapso-managed credentials | Prompts, context, files, tool inputs, and outputs. | United States |
| Anthropic PBC | Relevant AI model/features through Kapso-managed credentials | Prompts, context, files, tool inputs, and outputs. | United States |
| OpenRouter, Inc. | Relevant AI model routes through Kapso’s account | Prompts, context, model routing metadata, and outputs. The selected model determines the downstream inference provider and processing location. | United States; downstream model-provider locations may vary |
| ElevenLabs, Inc. | Audio transcription and related voice features | Audio recordings, transcription results, and associated technical metadata. | United States and provider locations |
| Exa Labs, Inc. | Agent web-search tool | Search objectives, queries, customer-provided context included in them, and results. | United States and provider locations |
| Twilio Inc. | Kapso-managed telephone-number, verification, or calling routes | Phone numbers, routing/verification data, and recordings/content where enabled. | United States and global network locations |
| SignalWire, Inc. | Kapso-managed telephone numbers, verification, or calling | Phone numbers, routing/verification data, and recordings/content where enabled. | United States and global network locations |
| Telnyx LLC | Kapso-managed telephone numbers, verification, or calling | Phone numbers, routing/verification data, and recordings/content where enabled. | United States and global network locations |
Messaging platform relationship
Meta Platforms, Inc., WhatsApp LLC, and applicable affiliates provide WhatsApp Business Platform connectivity. Messages, media, contacts, templates, business-account information, and delivery metadata are processed when customers use WhatsApp features. Meta/WhatsApp’s contractual role can vary by processing activity, including independent-controller activities. The applicable Meta/WhatsApp agreements govern those activities. Typical processing locations include the United States and global provider locations.
Customer-connected services
Services engaged directly by customers under their own accounts and agreements are disclosed separately as customer-connected services where appropriate. Credentials supplied by a customer are evidence to investigate the relationship, not an automatic exemption: a Kapso-engaged intermediary or Kapso-managed fallback remains in scope when it processes customer personal data.
Other vendors
The following disclosures concern personal information Kapso processes for its own account, billing, security, or marketing purposes, as described in the Privacy Policy. They are separate from the customer-data subprocessor scopes above.
| Provider | Purpose |
|---|---|
| Stripe, Inc. and applicable affiliates | Kapso subscription payments, prepaid credits, billing, invoicing, and fraud prevention. |
| UserCheck | Signup and account-email validation and abuse prevention. |
| Google Ads | Advertising conversion measurement and campaign attribution. |
| Meta Ads | Advertising conversion measurement and campaign attribution; separate from WhatsApp service processing. |
| X Corp. | Advertising measurement and campaign attribution where enabled. |
| PostHog, Inc. | Website and account analytics; separate from service diagnostics described above. |
| Plus Five Five, Inc. (Resend) | Account, onboarding, marketing, and business email; separate from service notifications described above. |
Locations, changes, and contact
Typical locations describe the service configuration or provider locations and are not a promise that every processing activity, support access, or network request is confined to one country. Exact contracting affiliates and processing locations may vary by provider service and configuration. International transfers are governed by the DPA.
Kapso will provide at least 15 days’ prior notice before a new subprocessor materially processes customer personal data, except where urgently necessary to maintain security or availability, as provided in Section 8 of the DPA. Customers may object within 15 days after notice on reasonable, documented data-protection grounds. The DPA governs the objection process and remedies.
Questions, objections, and notification-subscription requests: legal@kap.so.