> For the complete documentation index, see [llms.txt](/llms.txt)

# Sub-processors

Every third party that processes Glotto customer or personal data, what it receives, and the region it processes in — plus where your data lives.

A **sub-processor** is a third party that processes customer or personal data on our behalf in order
to deliver the Glotto service. This page lists all of them.

It is not a marketing page: it is the artefact a security review asks for, and it is checked against
our own infrastructure on every change, so it cannot quietly fall behind the systems it describes. A
third party our services actually send data to, but that is missing from the table below, fails our
build.

## Data residency

The hosted service runs entirely in **Microsoft Azure, East US 2** (Virginia, United States). Every
environment — development, staging, and production — uses that one region, because the database is
integrated into a private network and must sit alongside it.

The database has **no public endpoint**. Outbound network access from our own services is denied by
default and permitted only on the protocols the service needs.

If you need your data processed in another region, or isolated from other customers entirely, we can
run a dedicated single-tenant deployment for you. Contact us.

## Current sub-processors

| Sub-processor | Purpose | Data it receives | Processing region |
| --- | --- | --- | --- |
| Microsoft Azure | Compute, database, secrets, and object storage — the hosted service itself | Account and organisation data, customer specifications and generated artefacts | East US 2 (United States) |
| Azure Monitor / Application Insights | Operational logging and monitoring | Service logs and metrics; no secrets | East US 2 (United States) |
| Cloudflare | Edge network: DNS, WAF, and the tunnel our origin is reachable through | Request metadata and TLS termination; deploy and custom-domain provisioning for customer docs sites | Global edge network |
| Postmark | Transactional email — the magic links you sign in with | Your email address and the message we send you | United States |
| Stripe | Payment processing and billing | Billing contact and payment details, which Stripe collects directly | United States |
| Anthropic | The in-product Ask-AI assistant | The question you ask and the documentation context needed to answer it | United States |
| PostHog | Cookieless website analytics and client error reporting | Page paths, coarse event counts, and error types — no cookies, no profile, no personal identifiers | United States |
| Google Workspace | Business email and correspondence | Email addresses and the content of correspondence you send us | United States |

Payment card details are collected by Stripe directly and never reach our servers.

## Not sub-processors

These third parties are involved in delivering the service but do not process customer data on our
behalf, and are listed for completeness:

- **Version-control hosts** — GitHub, GitLab, Bitbucket, or your self-hosted instance. We push your
  generated SDKs to the repository *you* nominate, using credentials *you* supply. That destination
  is your choice and your controller relationship, not ours.
- **Package registries** — npm, PyPI, RubyGems, NuGet, pub.dev, and crates.io. When you run a
  publish, we upload the artefacts you asked us to publish, under your own registry credentials.
- **Your identity provider** — where your organisation uses single sign-on, we talk to the provider
  you configure. It is your vendor, not ours.
- **Internal tooling** that never touches customer data — our credential manager, for instance.

## Changes to this list

We review our sub-processors at least annually. Where we add one, we update this page and notify
affected customers **at least 30 days before** the new sub-processor begins processing customer
data, per the notice terms in our data processing agreement.

The "last updated" date at the top of this page is the date the list itself last changed.

## Questions

Email **privacy@glotto.dev**. For a security questionnaire or a vulnerability report, use
**security@glotto.dev**.