Subprocessors
Last updated: 4 November 2026
These are the companies that process data for ALIGN, what each one does and where. The tools your organisation connects (GitHub, Slack, Linear) and your own coding agent receive data because you connect or use them.
| Subprocessor | Role | Region |
|---|---|---|
| Google Cloud | hosting (Cloud Run), database and its backups (Cloud SQL), sign-in (Identity Platform), logs, error reports, traces and uptime checks (Cloud Logging, Error Reporting, Cloud Trace, Cloud Monitoring), key management (Cloud KMS, Secret Manager), export files (Cloud Storage) | United States (us-central1, Iowa) for data at rest |
| Google Cloud Agent Platform: Google's Gemini models | model processing of redacted text and redacted PR hunks; not used for training ("Google won't use your data to train or fine-tune any AI/ML models without your prior permission or instruction"); Google's project-level data caching, which by default keeps inputs, outputs and derived data in memory and on disk for up to 24 hours and is also what implicit context caching uses, is turned off in both our projects, staging and production (disableCache, set in our infrastructure code), so Google keeps no cached copy; request-response logging is off (Google's default) and we create no explicit caches; the one retention left is Google's abuse monitoring: only if its automated classifiers flag a request, Google may log the prompt for up to 90 days in the region or multi-region of the request, solely to check for policy violations, not encrypted with customer-managed keys and never used for training (this applies to customers on Google Cloud's online terms; a Google Cloud Master Agreement exempts it). Sources: Google's "Generative AI and zero data retention", "Context caching overview" and "Abuse monitoring" pages, read 22 Oct 2026 | the global endpoint: a request, and any abuse-monitoring log of it, may be processed in any Google region; we store nothing there |
| Resend | email delivery, including sign-in links | US |
| GitHub, Slack, Linear | the customer's own tools, via the apps they install | per vendor |
| Paddle | merchant of record for orders placed through online checkout, once it opens; until then we invoice paid plans ourselves and no billing provider receives your data | per vendor |
| Anthropic | only two kinds of data, never customer content: (a) evaluation cases for comparing model quality, made from synthetic fixtures and our own organisation's build sessions, sent through Anthropic's API; (b) operational data, because the agents that build and operate the service are Claude Code agents running on Anthropic's service, and they can read our production logs and error reports: ids, counts, durations, status codes, error codes and stack traces, which carry no content. The product's own model calls (compiling decisions, judging pull requests) use only Google's Gemini models on Agent Platform, never Claude; if that ever changes, this list changes first | per vendor |
| The member's own coding agent or connected app (such as Claude.ai or ChatGPT through the remote MCP endpoint) and its model provider | receives entries and quotes the member asks for through the agent tools, only after the member connects it and approves access for one organisation | the member's choice |
Changes
We announce a new subprocessor here, and by email to organisation owners, at least 14 days before it processes customer data. Owners can object as the data processing terms describe. Questions: privacy@bharatreachdsp.com.