Current Subprocessors
SiteGPT uses the following third-party service providers (subprocessors) to deliver our services. This list is maintained in accordance with our Data Processing Agreement obligations.
Last Updated: July 2026
Infrastructure & Hosting
| Subprocessor | Purpose | Location |
|---|
| Cloudflare, Inc. | Application hosting, content delivery, file storage, and security | Global |
Data Storage & Processing
| Subprocessor | Purpose | Location |
|---|
| Convex, Inc. | Backend database and application platform | United States (AWS) |
| Pinecone Systems, Inc. | Vector database for AI embeddings | United States (AWS) |
AI & Machine Learning
| Subprocessor | Purpose | Location |
|---|
| OpenAI, L.L.C. | AI language model processing | United States |
| Cohere Inc. | AI embeddings and language processing | United States |
Content Processing
| Subprocessor | Purpose | Location |
|---|
| Context.dev | Document and file parsing for uploaded knowledge sources | United States |
Observability & Analytics
| Subprocessor | Purpose | Location |
|---|
| Portkey AI | AI observability and logging | United States |
| PostHog | Product analytics | United States |
| DataFast | Marketing analytics | United States |
| Google LLC | Website analytics (Google Analytics) | United States |
| Dub Technologies, Inc. | Referral and affiliate link analytics | United States |
Email & Communications
| Subprocessor | Purpose | Location |
|---|
| Bento | Email marketing and communications | United States |
| AutoSend | Transactional email delivery (account emails only; no end user chat data) | United States |
Payments
| Subprocessor | Purpose | Location |
|---|
| Paddle | Payment processing (Merchant of Record; acts as an independent controller for payment data, not a subprocessor) | United Kingdom |
PHI Processing (HIPAA Deployments)
For customers with an executed Business Associate Agreement (see /legal/baa and /hipaa), PHI is scoped to end-user conversations (chatbot training content remains PHI-free by agreement), which restricts Protected Health Information to a minimal subprocessor chain, each member operating under its own BAA with SiteGPT before your BAA is executed:
| Subprocessor | Role in the PHI path |
|---|
| Convex, Inc. | Application database (conversations, chatbot content) |
| OpenAI, L.L.C. | AI responses and embeddings, zero-data-retention endpoints only |
| Pinecone Systems, Inc. | Vector search over chatbot content |
PHI does not flow to any other subprocessor on this page. These boundaries are enforced as preconditions of enablement: HIPAA processing is turned on for an account only once AI processing routes exclusively to OpenAI under zero data retention, conversation traffic is served directly from Convex infrastructure rather than through SiteGPT's general content delivery network, training content is confirmed PHI-free by agreement (which keeps content ingestion and queue subprocessors out of PHI scope), notifications to observability, analytics, and email subprocessors carry no PHI (human handover notifications link agents to the dashboard instead of embedding conversation details), and no analytics or session recording runs on chat surfaces or in the dashboards of BAA-covered workspaces. Until an account completes enablement, no PHI is permitted on it at all (see /hipaa).
Changes to Subprocessors
We give notice of the addition or replacement of a subprocessor that processes personal data on your behalf by updating this page at least 10 days before the new subprocessor processes such data. To receive change notifications by email, subscribe by sending an email to privacy@sitegpt.ai with the subject "Subscribe: subprocessor updates". Customers with an executed Data Processing Agreement additionally receive direct email notice. Where a replacement is urgently required for security, service continuity, or a subprocessor's failure, we may engage the replacement immediately for data not protected by the Standard Contractual Clauses (for SCC-protected data, the replacement does not process such data until the notice period has run or the affected customer approves earlier engagement), and we update this page without undue delay. Objection rights are as described in our Terms and, for Enterprise customers, the DPA at /legal/dpa.
Questions
If you have questions about our subprocessors or data processing practices, please contact us at support@sitegpt.ai.