# Subprocessors

These are the companies that process data for Runtime LLC to provide the
Services. The [Data Processing Addendum](/legal/dpa) explains how this list
changes. We add a new subprocessor to this page before it starts handling
customer data. The date at the foot of the page shows the last change. To
object to one, write to legal@withruntime.com.

| Company                      | What it does for us                                                                                 | Where         |
| ---------------------------- | --------------------------------------------------------------------------------------------------- | ------------- |
| OVH US LLC (OVHcloud US)     | The dedicated servers that run and store sandboxes, and storage for copies of paused sandboxes      | United States |
| Vercel Inc.                  | Hosts the website, the account pages and the API                                                    | United States |
| Neon (a Databricks company)  | Accounts, usage, billing, job output and sealed secrets                                             | United States |
| Stripe, Inc.                 | Takes card payments and keeps payment details                                                       | United States |
| Google LLC                   | "Continue with Google" sign-in, and our company email                                               | United States |
| Resend (Plus Five Five Inc.) | Sends sign-in links and account email                                                               | United States |
| Cloudflare, Inc.             | Runs our domains' DNS, checks that a new sign-up is a person, and receives email to withruntime.com | United States |
| Cloudflare, Inc. (CDN)       | Carries and caches the traffic to customers' Apps                                                   | Worldwide     |
| Anthropic, PBC               | Runs the AI model that answers support                                                              | United States |
| Slack Technologies, LLC      | Carries our team's alerts and support drafts, which can name you and quote your messages            | United States |

An AI agent, which a person can take over, handles support first. In a
conversation you start, it reads your organization's account (resources,
operations and errors, usage, billing and notices) to help you. It looks
inside a sandbox only after you approve that. The conversation and what the
agent read for it are sent to Anthropic's API. That API does not train on them.

Sandbox execution, and its local disks and memory, use OVHcloud US. The output of scheduled jobs and the secrets you store are kept in the database. The secrets are sealed.

## Independent recovery storage

| Company                            | What it does for us                                                                               | Where         |
| ---------------------------------- | ------------------------------------------------------------------------------------------------- | ------------- |
| Backblaze, Inc. (B2 Cloud Storage) | Stores encrypted off-server recovery copies of customer resource data and of the account database | United States |

The service's recovery status reports whether captures are enabled. This listing
alone does not mean every resource is backed up. Recovery records and receipts
remain in our database. Encryption keys are held separately from customer access.

Questions: legal@withruntime.com.