Subprocessors

Core platform vendors

These process data for every workspace. They are active whenever Saga Sprint is running.

• Vercel: application hosting, edge delivery, serverless or Node workloads, deployment logs.
• PostgreSQL provider (Supabase or equivalent): primary application database, vector search, and realtime refresh envelopes (workspace and event identifiers only, not record contents).
• Upstash: Redis used for rate limiting and scheduled-job locks, plus QStash wake-ups for leftover email send and inbox sync work. Stores counters, identifiers, and continue-tick URLs, not mailbox contents.
• S3-compatible object storage (AWS S3, Cloudflare R2, Supabase Storage): uploaded files, generated documents, and exports.
• Stripe: subscription billing, checkout, invoices, customer portal, tax features if enabled.
• Resend: transactional and campaign email sent by the platform.

AI vendors

AI features are optional. When they are used, the content of the request may include any workspace record the assistant was asked about, along with any file attached to it.

• Google Gemini: assistant conversations, document and CV extraction, and embeddings.
• OpenAI: assistant conversations, and embeddings when Gemini is unavailable.
• Anthropic: assistant conversations when selected for a workspace.
• Mistral AI: assistant conversations when selected for a workspace.
• A workspace may instead point Saga Sprint at its own AI endpoint, in which case no data reaches the vendors above.

Vendors a workspace connects itself

Nothing reaches these until someone in the workspace connects the account, and disconnecting stops the flow.

• Google Workspace: Gmail sync and sending, Drive files, Calendar events, Contacts, and Sheets when connected.
• Microsoft 365: mailbox sync and sending through Outlook and Microsoft Graph when connected.
• Meta (WhatsApp Cloud API): recipient phone numbers, message bodies, and media for WhatsApp messaging.
• Telegram: message text, chat identifiers, and files sent through a connected bot.
• Slack: notification and channel message content.
• HubSpot: contact name, email, phone, and company when contact sync is enabled.
• Cal.com: booking events received from a connected calendar.
• Any webhook destination the workspace configures, including Zapier and Make, receives the events it subscribes to.

Optional platform features

• ClickHouse: lead intelligence datasets and exports when the intelligence engine is enabled.
• Cloudflare Workers: optional legacy realtime fallback. Carries workspace and event identifiers, not record contents.

Services that receive no personal data

Listed for completeness. These are called with a search term only, never with a customer record.

• RxNav, operated by the U.S. National Library of Medicine: medication name lookup in the clinic module.
• Exa: web research used by Saga Sprint's own internal operator tooling, never by a customer workspace.
• Public FX reference feeds: currency pair codes and requested dates only. No personal data and no customer records.

Changes

Saga Sprint notifies affected customers of material subprocessor changes according to signed agreements or the DPA.

This list is generated from the same register the application enforces in its build, so a new vendor cannot ship before it appears here.