Dies ist Fassung 2, unverändert so, wie sie veröffentlicht wurde. Gültig ist Fassung 3. Gültige Fassung lesen
Dieses Dokument wird auf Englisch veröffentlicht. Maßgeblich ist die englische Fassung.
Rechtliches
ZeeDo sub-processors
Stand: 2026-10-30Fassung 2Alle Fassungen (PDF)
Annex 3 — Sub-processors
These are the sub-processors ZeeDo engages for the ZeeDo service, with the sites where they process data. ZeeDo gives at least 30 days' notice, by email to the Owners and on this list, before adding or replacing a sub-processor, as section 5.3 of the Data Processing Addendum provides.
In the tables, "SCCs" means the Standard Contractual Clauses adopted by the European Commission (Implementing Decision (EU) 2021/914), as the recipient's data processing terms incorporate them. "DPF" means the EU–US Data Privacy Framework (the Commission's adequacy decision of 10 July 2023); it is named only where the recipient states that it is certified under it, and then in addition to the SCCs. "None needed (EEA)" means that the data stays with a company in the European Economic Area.
3.1 Hosting sites
| Vendor | Function | Data | Location | Transfer mechanism |
|---|---|---|---|---|
| Scaleway SAS (Elastic Metal dedicated servers; Scaleway Object Storage) | Bot machines and their snapshots and recordings, the control-plane server, ZeeDo's own embedding and reranking models and the self-hosted software in 3.5; the primary object-storage buckets | Customer Content | Paris region (fr-par), France | None needed (EEA) |
| OVH (OVH Object Storage) | The replica of the object-storage buckets only | Customer Content, encrypted by ZeeDo before it is stored | Limburg, Germany | None needed (EEA) |
| Amazon Web Services | The region that hosts Neon, Temporal Cloud, AWS KMS and Amazon SES | The data of those services, as 3.2 and 3.3 describe | Frankfurt region (eu-central-1), Germany | SCCs in Amazon Web Services' data processing terms, and the DPF, under which Amazon Web Services states it is certified |
3.2 Vendors that may touch Customer Content
| Vendor | Function | Data | Location | Transfer mechanism |
|---|---|---|---|---|
| Neon (Databricks, Inc. and its subsidiary Neon, LLC) | Managed PostgreSQL database with pgvector | All database rows: bots, runs, checkpoints, memory, the audit log, cost records | Amazon Web Services' Frankfurt region (eu-central-1), Germany | SCCs in Neon's data processing terms, and the DPF, under which Neon states it is certified |
| Temporal Technologies (Temporal Cloud) | Workflow orchestration for bot runs | Workflow history and payloads | Amazon Web Services' Frankfurt region (eu-central-1), Germany | SCCs in Temporal's data processing terms |
| Amazon Web Services (AWS KMS) | Key management: the keys that protect vault credentials, provider keys, stored objects and signing keys | Key material and wrapped data keys; no Customer Content in readable form | Frankfurt region (eu-central-1), Germany | SCCs in Amazon Web Services' data processing terms, and the DPF, under which Amazon Web Services states it is certified |
| Vercel (Vercel Inc.) | Hosting of the web application and its API routes | Data served to the dashboard and the API | Functions in Frankfurt (fra1), Germany; content delivery through Vercel's global edge network | SCCs in Vercel's data processing terms, and the DPF, under which Vercel states it is certified |
| Langfuse GmbH, part of the ClickHouse group (Langfuse Cloud) | Trace store: the record of each run's steps and model calls | Traces: their metadata (identifiers, timings, counts), kept 13 months, and their bodies (prompts, responses and tool results), kept 30 days | Langfuse's EU region on Amazon Web Services in Ireland (eu-west-1); support from the United States under its terms | None needed (EEA) for the EU region; SCCs in Langfuse's data processing terms for support from the United States |
| Grafana Labs (Raintank, Inc.; Grafana Cloud) | Logs, metrics, service traces and alerts of ZeeDo's systems | Identifiers and network addresses; the logs of the servers that run bot machines also hold the commands a bot ran, with their arguments, the paths of the files it wrote (not their contents) and the hosts it reached | An EU region of Grafana Cloud in Germany | SCCs in Grafana Labs' data processing terms, and the DPF, under which Grafana Labs states it is certified |
| OpenRouter (OpenRouter, Inc.) | ZeeDo's model: the default model access of every workspace on every plan, unless the Customer uses BYOK or switches it off; it passes each request to the provider named for the model | Prompts and model responses of workspaces on ZeeDo's model, restricted to providers that keep no copy of them (zero data retention) and do not train on them | OpenRouter, Inc. is in the United States. For an organisation of ZeeDo's EU region, requests are processed in the EU through OpenRouter's EU endpoint, and a request is refused rather than sent elsewhere; for other regions, through the endpoint named for the region. The decision model is reached from the United States for every region, unless an organisation keeps every model check in the EU | SCCs in OpenRouter's data processing terms |
| Microsoft (Azure), as OpenRouter's sub-processor | Serves ZeeDo's default model | Prompts and model responses on ZeeDo's default model | Azure's EU endpoint; processed in the EU | SCCs in OpenRouter's data processing terms, and the DPF, under which Microsoft states it is certified |
| Perplexity, as OpenRouter's sub-processor | Serves the decision model that reads the rules people set for a bot, and that checks what a control a bot is about to press would do | For the rules: the typed text of a message that sets or changes a rule for a bot, and the words of the rules it concerns; also the start of a request to a bot whose rules do not all fit in front of it; what a person pastes, and anything a bot read, are not sent. For a press: the labels of the control, of its form's fields and of a dialog it answers, the currencies shown, the site's domain and the pattern of the form's address, whose parts written only in lower-case letters are kept as written and may be a name; field values, page text and links are never sent; inside a label, numbers written in digits, email addresses, phone numbers, account and card numbers and web addresses are replaced by placeholders, and its other words are sent as written and may name third parties, streets or places; pages of sensitive sites and of webmail are never sent | United States, for every region, unless an organisation of ZeeDo's EU region keeps every model check in the EU | SCCs in OpenRouter's data processing terms |
| Scaleway SAS (Scaleway Object Storage), with a replica at OVH | Regional object storage: snapshots, home volumes, recordings, files, the full text of memory episodes, the audit log's hourly copy, and export archives, which are kept at Paris only | Customer Content, encrypted by ZeeDo before it is stored, except export archives | Paris (fr-par), France; replica in Limburg, Germany | None needed (EEA) |
3.3 Vendors that process account, identity, billing or notification data
ZeeDo is the controller for much of this data (the Privacy Policy describes it). These vendors are listed here so that the list is complete.
| Vendor | Function | Data | Location | Transfer mechanism |
|---|---|---|---|---|
| WorkOS (WorkOS, Inc.) | Sign-in (AuthKit), single sign-on and directory sync (SCIM) | Members' identity and sign-in data | United States | SCCs in WorkOS's data processing terms |
| Stripe (Stripe Payments Europe, Limited) | Checkout, subscriptions, invoices and tax. Stripe is an independent controller for payment processing and fraud prevention; for its billing services it is ZeeDo's processor | Billing contacts, the legal entity's name and address, VAT ID, invoices; payment details, which Stripe collects and ZeeDo never receives | Ireland; Stripe's group also processes data in the United States | SCCs in Stripe's data processing terms, and the DPF, under which Stripe states it is certified |
| Amazon Web Services (Amazon SES) | Transactional email: alerts, notices and approval mirrors | Recipient address, message content | Frankfurt region (eu-central-1), Germany | SCCs in Amazon Web Services' data processing terms, and the DPF, under which Amazon Web Services states it is certified |
| Better Stack | Uptime probes and the public status page, with subscriptions by email | Probe results; status-page subscribers' email addresses | The United States and other countries where Better Stack and its sub-processors operate, as its data processing terms state | The DPF, under which Better Stack's data processing terms state it is certified; the SCCs in those terms apply where the DPF does not |
Browser push notifications use standard Web Push (VAPID) and are sent from ZeeDo's own servers, with no push vendor. Each message is encrypted end to end and relayed by the push service of the recipient's browser maker, which cannot read it and sees only an endpoint and the time; these relays are transmission services, not sub-processors. If ZeeDo releases native mobile apps, their notifications will go through Apple's and Google's push services, and ZeeDo will add those services to this list, with notice, before the apps are released.
3.4 Operational services (no Customer Content)
| Vendor | Function | Data | Location | Transfer mechanism |
|---|---|---|---|---|
| Functional Software (Sentry) | Error reports of the application | Error reports built only from the error's type, the place in ZeeDo's code where it arose and a closed list of labels; never text a person or a bot wrote, and no personal data | Sentry's EU region, Germany | SCCs in Sentry's data processing terms, and the DPF, under which Sentry states it is certified |
Alerts to ZeeDo's on-call staff carry only an alert's name, its severity, a fixed summary and the address of its runbook, with no Customer Content and no personal data. A service that only delivers them to the staff is therefore not a sub-processor. If a provider in this section is to receive Customer Personal Data, it is added to 3.2 with the notice section 5.3 of the Data Processing Addendum requires.
3.5 Not sub-processors (self-hosted software on ZeeDo's own servers)
These run on ZeeDo's servers at Scaleway above (3.1), so the site is the sub-processor, not the software's author: Nango (integrations gateway); coturn (the relay for live screen viewing); Valkey (budget ledger and caches); the Web Push sender; and ZeeDo's own embedding model (BAAI/bge-m3, an open model under the MIT licence) and reranking model (bge-reranker), served by Hugging Face's open-source Text Embeddings Inference beside ZeeDo's model gateway. Memory text, memory searches and the descriptions of a workspace's tools are embedded there, and memory search results ordered there, for every workspace; no embeddings vendor is used.
3.6 Chosen by the Customer (not ZeeDo sub-processors)
- Model providers under BYOK (for example Anthropic, OpenAI, Google, xAI, Mistral, DeepSeek, AWS Bedrock, Azure OpenAI, Vertex AI, Groq, Together, Fireworks, OpenRouter on the Customer's own key, and custom endpoints). The Customer contracts with the provider directly; the provider is the Customer's own processor. Embeddings follow the workspace's embedding model, not the bots' keys: ZeeDo's own model (3.5) whatever key the Customer's bots use, or an OpenAI embedding model of the Customer's own account where an Owner or Admin chose one, in which case OpenAI is the Customer's own processor for that workspace's memory text.
- Connectors and MCP servers the Customer connects.
- Websites a bot visits.