Sub-processors
Last updated: October 4, 2026
This live list covers third parties that process Customer Personal Data to deliver Zentrik’s services. This page is informational. Contractual commitments are in the Order Form, Terms, and any executed DPA.
Notice and changes
We notify customers of intended additions or replacements by email or in-product notice. The change is effective upon notice. Customers may object on reasonable, documented privacy or security grounds within 10 days. In urgent cases required for security, continuity, or bug fixes, we may engage a Sub-processor immediately and will provide notice without undue delay.
Security: security@zentrik.ai | Privacy: privacy@zentrik.ai
Current Sub-processors
| Sub-processor | Purpose | Data handled | Region | Transfer mechanism |
|---|---|---|---|---|
| Fly.io, Inc. | Application hosting and managed Postgres | All Workspace Data | mad (EU), sjc (US) | Standard transfer terms may be executed on request where applicable |
| Amazon Web Services, Inc. (S3) | Object storage | Uploaded files, text extracted from them, imported source text (for example support tickets and transcripts), and generated documents | us-east-2 (US) | Standard transfer terms may be executed on request where applicable |
| Sentry.io, Inc. | Error monitoring and performance diagnostics | Error metadata and operational diagnostics | United States | Standard transfer terms may be executed on request where applicable |
| Google LLC (OAuth, reCAPTCHA, Gmail SMTP) | Authentication, bot protection, email delivery | Security and device telemetry, SSO assertions, email metadata/content | United States | Standard transfer terms may be executed on request where applicable |
| AC PM LLC (Postmark) | Delivery of account, product, and update email, with delivery and suppression event processing | Recipient and sender addresses, message content, and delivery, bounce, complaint, and subscription-change events | United States | Standard transfer terms may be executed on request where applicable |
| OpenAI, L.L.C. | AI text generation and processing (API) | Prompt text and contextual project content supplied by Customer | United States (provider-dependent) | Standard transfer terms may be executed on request where applicable |
| PostHog, Inc. | Optional browser product analytics, masked session recordings where permitted, and bounded service telemetry | IP address, device/OS, browser, timestamps, bounded event and operational metadata, and opaque user and workspace identifiers; browser analytics is configured not to include names, email addresses, or Workspace Data | United States | Standard transfer terms may be executed on request where applicable |
| Slack Technologies, LLC | Support communications | Names, contact details, and support interaction content | United States | Standard transfer terms may be executed on request where applicable |
Notes
- Public website page views are measured without cookies or any device-stored identifier. Identified product analytics starts only after explicit consent where required and can be disabled through Privacy choices elsewhere. A named product User's opaque account ID and display name may label the PostHog person profile; unnamed Users, Ideas Portal visitors, and optional service telemetry remain profileless.
- No customer content is intentionally sent to analytics.
- Masked session recordings may start by default in Australia and New Zealand; elsewhere we ask before recording. Existing refusals and workspace restrictions still apply. Text and attributes are masked, content media and inputs are blocked, and console logs and network details are excluded.
- Zentrik manages customer-specific analytics restrictions. Existing workspace opt-outs remain effective. Contact privacy@zentrik.ai for workspace requirements.
- Customer-enabled integrations (for example, Jira) are initiated and controlled by the customer and are not Zentrik Sub-processors by default. This includes prototype tools such as v0, which run on the customer's own account and API key and receive the prototype specification the customer sends them.
Change management and remedies
If a customer objects and the parties cannot resolve the objection, the customer may suspend the affected processing or terminate the impacted services, and Zentrik will provide a pro-rata refund of prepaid fees for the terminated portion.
Data handling references
- Data residency: primary hosting on Fly.io sjc (US); object storage on AWS S3 us-east-2 (US).
- Retention: encrypted nightly snapshots retained 5 days on a rolling basis and purged by rotation.
Recent changes
- October 4, 2026: Removed Anthropic and the optional Gemini path, which no product feature uses; described what AWS S3 stores; named prototype tools as customer-enabled integrations.
- September 21, 2026: Updated regional recording defaults and centrally managed workspace restrictions.
- September 9, 2026: Added workspace analytics restrictions and conditions for masked session recordings.
- August 25, 2026: Removed Google Analytics and limited browser product analytics to bounded PostHog events with region-appropriate privacy controls.
- July 25, 2026: Confirmed infrastructure, monitoring, analytics, support, and optional AI processing providers.
- February 16, 2026: Updated analytics data-handling detail for authenticated users.
- February 5, 2026: Updated notice, transfer, and retention language to align with the DPA.
Questions
For privacy or security questions, contact privacy@zentrik.ai or security@zentrik.ai.
Company legal contact
Zentrik Company
490 Post St, Ste 500, PMB 2017
San Francisco, CA 94102, USA
Legal: legal@zentrik.ai | Privacy: privacy@zentrik.ai | Security: security@zentrik.ai