Subprocessors
Who processes customer data on Userz's behalf, what for, and where.
Last updated: 16 October 2026
Residency
Userz processes and stores customer data in the United States only; no EU intake or storage zone is offered.
Each subprocessor below that holds customer data does so in the United States. The two rows marked “your account” are services you connect with your own credentials — they process data where your account lives, under your agreement with them.
Subprocessors by category
| Name | Type | Description |
|---|---|---|
| Cloud infrastructure and managed databases | United States | Runs the Service and hosts the databases that hold signals, telemetry, directives and account data. |
| Object storage | United States | Holds screenshots, attachments, replay clips, build artefacts and operational logs. |
| Content delivery, DNS and edge network | United States (origin); worldwide points of presence for delivery | Serves the website and SDK assets and fronts the API. Only public assets are cached at the edge; customer data is stored in the United States. |
| AI model providers | United States | Process signals and related content to provide the Service, and generate proposed code changes. Each provider is named in the next section. Before any AI model sees a signal, Userz removes API keys, tokens and other secrets, signed session tokens (JWTs), email addresses, payment card numbers, US Social Security numbers, North American phone numbers, IPv4 addresses; an organization may choose to keep a category, such as email addresses, unredacted. |
| Payment processing | United States | Handles card details and subscriptions, once paid plans exist. Userz receives a customer reference, subscription status and invoice metadata, never the card. |
| Transactional email | United States | Delivers account, digest and notification email to your team. |
| Source-code hosts | Your account, your region | Invoked only when you connect a repository, and only for the repositories you connect. Userz reads and writes through your own account on that host; it is your provider, not a Userz subprocessor in the usual sense, and its location is wherever your account lives. |
| Notification and issue-tracking platforms | Your account, your region | Invoked only when you connect an integration (a chat workspace, an issue tracker, a product-analytics tool). Signals flow from and to your own workspace on that platform under its terms. |
Every subprocessor is bound by written terms requiring confidentiality, security and data-protection obligations consistent with the Data Processing Addendum, and each is given access only to what its function needs.
AI model providers
| Name | Type | Description |
|---|---|---|
| Anthropic | United States | Processes signals and related content, including code, to provide the Service, and generates proposed code changes. Deletes API inputs and outputs within 30 days by default, keeping them longer only where content is flagged under its usage policy or the law requires it. Under its published terms, it does not train its own models on the data Userz sends. |
| DeepInfra | United States | Hosts AI models that process signals to provide the Service. Holds inference inputs and outputs in memory only and does not store them; it logs request metadata such as the request identifier, cost and sampling parameters. Under its published terms, it does not train its own models on the data Userz sends. |
| OpenAI | United States | Processes signals and related content, including code, to provide the Service, and generates proposed code changes. Keeps API inputs and outputs for up to 30 days to detect abuse, then deletes them, unless the law requires longer or longer retention is needed to protect its services or others from harm. Under its published terms, it does not train its own models on the data Userz sends. |
| TypeSafe (Jev) | United States | Processes signals to provide the Service. Its terms state no fixed period: data is kept as long as reasonably necessary to provide its service or for its business purposes. Under its published terms, it does not train its own models on the data Userz sends. |
This list will grow: Userz adds AI providers as the Service improves, and names each one on the subprocessors page before it processes customer data.
Userz may also process customer data on computing hardware that Userz owns and operates in the United States, connected over encrypted channels. That hardware is a Userz processing location, not a subprocessor.
The named list
The AI model providers are named above. A current list naming the providers in the other categories is available on request to [email protected]. Userz gives reasonable advance notice of a material addition or replacement so that customers with concerns can raise them before the change takes effect.