Subprocessors

A subprocessor is a company Capstan uses that may process personal data from customer workspaces. Each one is bound by a contract that protects data at least as well as our Data Processing Agreement, and is reviewed by our security team before we use it and every year after.

Where a workspace uses EU data residency, its data is processed in the EU locations below, except where the table says otherwise.

Current subprocessors

Company	What it does for Capstan	Data it processes	Where
Amazon Web Services	Hosting, databases, backups and the run workers	All workspace data, encrypted	US (Virginia) or EU (Frankfurt)
Cloudflare	Network delivery and protection against attacks	Network traffic, IP addresses	Global edge, nothing stored
Anthropic	AI models for agent steps	The text a step sends, under zero retention	US
OpenAI	AI models for agent steps, where a workspace chooses them	The text a step sends, under zero retention	US
Stripe	Billing and invoices	Billing contacts, company details	US
Resend	Sending account and approval emails	Email addresses, email content	US or EU
Datadog	Monitoring and error tracking	Service logs, with workspace content removed	US or EU
Zendesk	Customer support	Support conversations	US

Getting notice of changes

We email every workspace admin at least 30 days before we add or replace a subprocessor, with what it will do and where. To get the same notice without a workspace, for example for your procurement team, write to legal@capstan.example.

Your own tools are not on this list

The tools your agents connect to (your Stripe, Zendesk or HubSpot account, for example) are chosen by your company and covered by your own agreements with them. Capstan only sends them what your agents are allowed to.