Subprocessors
Last updated:
Trelus, Inc. uses third-party service providers to operate, secure, support, and improve our services. The tables below describe the providers used within Trelus, the nature and purpose of their processing, and links to their privacy, contractual, and security information.
Not every provider receives data from every customer. Processing depends on the features you use and the accounts you connect. We list customer-connected integrations and website services separately because their providers may act under your own agreement or as independent controllers, rather than solely as Trelus subprocessors.
Processing locations depend on the service, deployment, and account settings. Where a location is not specified here, consult the linked provider documentation or contact us. A hosting region does not necessarily limit support access, transfers, or downstream processing to that region. This page does not create a data-residency or retention commitment or replace your agreement with Trelus.
Core service subprocessors
Providers used within Trelus for application hosting, storage, authentication, billing, email, and product analytics. Some providers, such as Stripe, also process certain information as independent controllers under their own terms.
Scroll the table horizontally to view all columns.
| Provider | Nature and purpose of processing | Processing location | Additional information |
|---|---|---|---|
| Vercel | Application hosting, server execution, content delivery, and web analytics. Processes web requests, application data handled by hosted functions, logs, and website usage information. | Primary facilities in the United States; global processing and delivery locations. | |
| Amazon Web Services (S3) | Object storage for company and private documents, uploaded attachments, and files generated in advisor workspaces. Bedrock inference is listed separately below. | Configured AWS storage region. Service-initiated transfers and other processing are subject to AWS’s terms. | |
| Neon (Databricks) | Managed PostgreSQL hosting for application records, including users, companies, business context, work items, permissions, and integration connection records. | Selected Neon project region. Other processing is governed by the applicable Databricks terms. | |
| Clerk | Sign-in, user identity, sessions, organizations, memberships, and invitations. Processes account and contact details and authentication-related device and request information. | United States hosting; see Clerk’s security and transfer information. | |
| Stripe | Subscription checkout, payments, invoicing, seat billing, and AI credit purchases. Processes billing contacts, payment information, customer identifiers, and transaction records. | International processing, including the United States and India. | |
| Resend | Email delivery and contact management for welcome messages, invitations, access requests, subscription notices, and other communications. Processes recipient details, email content, and delivery records. | United States storage and primary processing; sending regions may differ. | |
| PostHog | Product analytics and error diagnostics. Processes user and company identifiers, profile details, page views, feature events, and event properties that can include research queries. | US Cloud endpoints; international transfers and support processing are described in PostHog’s DPA. |
AI, document processing, and research
These providers support the advisor and related features, including background analysis. Depending on the operation, processing can include conversation content, business context, documents, tool inputs and outputs, or research queries. Not every request uses every provider.
Scroll the table horizontally to view all columns.
| Provider | Nature and purpose of processing | Processing location | Additional information |
|---|---|---|---|
| Anthropic | Claude models power advisor responses, planning, summaries, conversation titles, and business-context analysis. Processes prompts, relevant conversation history, retrieved content, and generated responses. | US storage; inference may run in the US, Europe, Asia, or Australia, depending on service arrangements. | |
| Amazon Web Services (Bedrock) | Hosts Claude inference as a fallback when the primary Anthropic model request cannot be served. Processes the prompts, context, and responses needed for that request through AWS. | Depends on the configured inference profile. Geographic profiles route within that geography; global profiles can route worldwide. | |
| OpenAI | Creates text embeddings for semantic conversation recall. Processes conversation text to produce numeric representations used to retrieve relevant past messages. | Depends on API project settings; regional storage and regional processing have separate requirements. | |
| LandingAI | Agentic Document Extraction converts submitted documents into text and structured content for analysis. Processes file contents and filenames, including asynchronous jobs for large documents. | US (Ohio) or EU (Ireland), depending on the ADE service endpoint and account. | |
| Blaxel | Isolated cloud workspaces execute advisor-generated code and commands to analyze data and create deliverables. Processes files made available to the workspace, commands, and execution output. | US or European deployment regions, depending on workspace configuration. | |
| Braintrust | AI observability and diagnostics. Stores execution traces that may include model inputs and outputs, tool calls and results, timing, errors, and associated identifiers. | US primary operations; an EU data plane is available for eligible accounts. Location depends on the configured deployment. | |
| Exa | Web search and website content retrieval for advisor research and company context. Processes search queries, requested URLs, and retrieved web content; queries may contain business information relevant to your request. | United States for standard hosted service; custom arrangements may differ. |
Integration infrastructure: Composio
Composio brokers the connections marked below. It manages authorization credentials and processes API requests and responses between Trelus and the connected provider. It is not involved in the direct Ninety connection.
Scroll the table horizontally to view all columns.
| Provider | Nature and purpose of processing | Processing location | Additional information |
|---|---|---|---|
| Composio | OAuth connections and tool execution for third-party integrations. Holds authorization credentials and processes account identifiers, request parameters, and returned business records or document content. | Composio Cloud is hosted in the United States. Connected providers have their own processing locations. |
Customer-connected integrations
This is Trelus’s supported integration catalog, not a list of connections enabled for every customer. Availability depends on your plan and which integrations Trelus offers in your environment. You must connect an account before Trelus can use it. Only curated read-only tools are on by default; write tools require you to enable them. Retrieved information may then be processed by the Trelus storage and AI providers above. Your agreement with each connected provider also applies.
Scroll the table horizontally to view all columns.
| Provider | Nature and purpose of processing | Processing location | Additional information |
|---|---|---|---|
| Google — Google DriveVia Composio | Find and read files, documents, spreadsheets, presentations, metadata, and comments in your connected Drive account. Enabled write tools can create or update content. | Depends on your Google account and applicable Workspace data-region settings. | |
| Microsoft — SharePointVia Composio | Search and read sites, document libraries, files, lists, intranet pages, and Excel workbook content through Microsoft Graph. Enabled write tools can modify supported records. | Depends on your Microsoft 365 tenant geography and service settings. | |
| Intuit — QuickBooks OnlineVia Composio | Read financial reports, invoices, bills, payments, customer and vendor records, and product data from your connected company. Enabled write tools can modify supported accounting records. | Subject to your Intuit account and service terms; international processing may apply. | |
| PipedriveVia Composio | Read deals, leads, contacts, organizations, activities, notes, and pipeline statistics for sales analysis. Enabled write tools can modify supported CRM records. | Depends on your Pipedrive account hosting and processing arrangements. | |
| Zoho — Zoho CRMVia Composio | Read leads, deals, accounts, contacts, notes, and activities to analyze your sales pipeline and follow-up. Enabled write tools can modify supported CRM records. | Depends on your Zoho account data center and service terms. | |
| Zoho — Zoho BooksVia Composio | Read invoices, bills, expenses, contacts, items, and bank account activity for financial analysis. Enabled write tools can modify supported accounting records. | Depends on your Zoho account data center and service terms. | |
| Ninety.ioDirect connection — not through Composio | Read teams, Rocks, To-Dos, Issues, Milestones, and Scorecard measurables. Enabled write tools can update supported records. Trelus stores the personal access token you provide and calls Ninety’s API directly. | Subject to Ninety’s hosting and processing arrangements; see its privacy policy. |
Website, advertising, and embedded media
These services support website measurement, advertising, or embedded media, rather than connecting your business accounts to the advisor. They may process browser, device, cookie, page-view, and interaction data under their own terms. See our Privacy Policy for information about cookies and your choices.
Scroll the table horizontally to view all columns.
| Provider | Nature and purpose of processing | Processing location | Additional information |
|---|---|---|---|
| Google (tags and YouTube) | Google measurement and advertising tags, Google Tag Manager, and embedded YouTube demo videos. Processing can include page URLs, IP addresses, device information, and video interactions. | Global processing under Google’s policies. | |
| LinkedIn Insight Tag and tracking pixel for advertising attribution and audience measurement, including page visits and browser or device identifiers. | United States and other countries, as described in LinkedIn’s privacy policy. | ||
| Meta (Facebook) | Meta Pixel for page-view events, advertising attribution, and audience measurement, including browser or device identifiers. | Global processing, including the United States. |
Updates and questions
This list may change. Updates will be posted on this page.
Links lead to each provider’s own trust center or security information, terms, privacy policy, and published subprocessor information where available. Some documents require an access request. A provider’s list may cover services Trelus does not use; it is not a list of additional vendors directly engaged by Trelus.
For questions about our providers or processing locations, contact info@trelus.io.