Subprocessors
Subprocessors
Effective date: July 2, 2026. This page lists subprocessors and connected-provider categories used or expected for Monocrat private beta and v1 launch. Availability may vary by environment, feature, customer profile, and written order.
1. Notice
Monocrat uses subprocessors to provide hosting, storage, security, support, billing, AI processing, email, observability, and connected service functionality. Customer-authorized integrations may also process data under the customer's own account or provider agreement.
Monocrat may update this list as the service changes. Material additions are handled under the Data Processing Addendum. Listing a provider does not approve every feature from that provider; route-specific approval is still required where retention, logging, no-training, deletion, residency, or human-review behavior differs by feature, endpoint, model, account configuration, or customer order.
2. Core Platform Subprocessors
| Provider | Purpose | Data categories | Status |
|---|---|---|---|
| Cloudflare | Public website delivery, DNS/CDN, edge security, bot protection, and related logs. | Website requests, IP address, user agent, headers, public site interaction metadata. | Active for public website. |
| Google Cloud Platform | Cloud Run, Cloud Storage, Pub/Sub, Cloud Tasks, Cloud Scheduler, Secret Manager, logging, monitoring, Vertex AI, and related infrastructure. | Account metadata, tenant-scoped product data, source refs, artifacts, logs, secrets, prompts/outputs where routed, operational metadata. | Launch platform. |
| Google Workspace | Monocrat operational email and customer-authorized Gmail, Drive, and Calendar source access. | Email, file, calendar, identity, source-health, and provider metadata when authorized. | Active or customer-authorized by profile. |
| Neon | Serverless Postgres operational data store for tenant state, waitlist, workflow state, billing state, source metadata, and audit records. | Tenant records, account metadata, workflow state, billing metadata, source refs, audit events, structured product records. | Launch platform. |
| Neo4j AuraDB | Graph database for tenant-scoped canonical business facts and graph traversal. | Source-backed business facts, graph nodes and edges, provenance, source refs, verification state. | Launch platform where graph storage is enabled. |
| Google Memorystore for Valkey | Ephemeral sessions, rate-limit buckets, locks, in-progress markers, and invalidatable caches. | Session IDs, temporary state, cache keys, rate-limit metadata. | Launch platform. |
| Resend | System email delivery and notification fallback. | Email address, message metadata, service notices, support or review notification content. | Configured where outbound system email is enabled. |
| Stripe | Monocrat subscription billing, Customer Portal, payment methods, invoices, receipts, direct charges, refunds, disputes, and chargebacks. | Billing contact, payment method references, invoice/receipt data, payment and dispute metadata. | Launch billing processor. |
3. AI And Model Processing Providers
| Provider | Purpose | Data categories | Status |
|---|---|---|---|
| Anthropic | Claude model processing through Vertex AI where supported or direct Anthropic fallback for approved models, batch, or API behavior. | Prompts, source excerpts, structured records, retrieval context, outputs, metadata, and batch results where routed. | Approved baseline/fallback route; feature-specific retention and zero-data-retention eligibility must be confirmed before use. |
| OpenAI | Approved AI or embedding processing where the route, data class, quality, security, and customer commitments allow it. | Prompts, source excerpts, structured records, embeddings, outputs, and metadata where routed. | Allowed only after route-specific approval; API data-sharing controls must remain off unless Customer expressly approves otherwise. |
| Google Vertex AI / Gemini | Gemini or Vertex AI model processing, grounding, retrieval, embeddings, and model gateway routes where approved. | Prompts, source excerpts, public-source retrieval context, structured records, outputs, embeddings, and metadata where routed. | Candidate or approved route by workflow and data class; paid-service training restrictions, abuse-monitoring retention, and grounding/caching exceptions must be reviewed per route. |
| xAI / Grok or negotiated frontier providers | Future or alternate model routing only after legal, provider, data-governance, security, quality, and source-policy gates are approved. | Prompts, source excerpts, outputs, and metadata only for approved data classes and routes. | Not active unless separately approved. |
4. Customer-Authorized Connected Providers
The providers below are often connected under the customer's own account or authorization. They may be independent controllers, processors, service providers, payment processors, or connected-service providers depending on the workflow and provider terms.
| Provider | Purpose | Data categories | Status |
|---|---|---|---|
| Customer's Google Workspace | Gmail, Drive, and Calendar source-backed product workflows. | Email, files, calendar events, metadata, source refs, permissions, and source-health data. | Customer-authorized after approval. |
| Customer's Stripe account | Tenant payment-source evidence for sales, payouts, refunds, disputes, and reconciliation. | Payment, refund, dispute, payout, customer, invoice, and webhook evidence from the tenant Stripe account. | Customer-authorized where selected. |
| Square | Payment, order, refund, receipt, catalog, and seller evidence for supported tenant profiles. | Order, payment, refund, receipt, customer, catalog, location, webhook, and source-health metadata. | Customer-authorized where selected. |
| Shopify / Shopify Payments | Order, product, inventory, transaction, refund, payout, and payment evidence. | Shop, order, customer, product, inventory, transaction, refund, payout, and webhook metadata. | Customer-authorized where selected. |
| Plaid | Bank transaction and settlement evidence for cash, FinOps, and reconciliation workflows. | Institution, account, transaction, balance, webhook, sync, and source-health metadata. | Customer-authorized where selected. |
| Moov | Selected v1 outbound payment rail adapter for approved payment execution flows with no Monocrat custody. | Payment capability, recipient, account, transfer, status, event, and reconciliation metadata where enabled. | Provider approval and action-gate dependent. |
5. Questions Or Objections
Questions or subprocessor objections can be sent to privacy@monocrat.ai. Billing processor questions can be sent to billing@monocrat.ai.