SUBPROCESSORS · EFFECTIVE 2 SEPTEMBER 2026
Subprocessor List
CONSELA uses the following providers or provider categories to operate the Service. The list describes intended production integrations and must be checked against the deployed configuration and provider contracts before launch. Business customers may request the applicable Data Processing Addendum.
CONSELA's research providers receive generated search queries and necessary request metadata. They do not receive the full workspace, brief or uploaded documents as a separate research payload. Generated queries may contain workspace-derived information; users should avoid including personal data, credentials or information they do not want disclosed to a search provider. Unless a row states an EU-only location, the provider may process data internationally. Where required for a restricted transfer, CONSELA relies on the provider's Data Processing Addendum and Standard Contractual Clauses or an applicable adequacy decision.
| Provider | Purpose | Data potentially processed | Location |
|---|---|---|---|
| Hetzner | Application, database and file hosting | Workspace, account and technical logs | EU Central infrastructure |
| Stripe | Payment details, billing, subscriptions, invoices and tax | Billing and contact identifiers | International processing; Stripe is the billing system of record. Stripe DPA and SCCs or adequacy mechanism where required |
| OpenRouter | AI inference provider | Prompts, context, outputs and telemetry | International processing; configured inference routes offer zero data retention; endpoint-specific DPA/SCC terms apply |
| Brave Search | Web research | Search queries, URLs and request metadata | International processing; API DPA/SCC terms apply where required |
| Exa | Web research | Search queries, URLs and request metadata | International processing; provider DPA/SCC terms apply where required |
| Tavily | Web research | Search queries, URLs and request metadata | International processing; provider DPA/SCC terms apply where required |
| ZeptoMail (Zoho Corporation) | Account verification and transactional service email | Email address, recipient name, message content and delivery metadata | International processing; Zoho DPA/SCC terms apply where required |
| Google Drive API (Google LLC) | User-authorized file import | Selected file content, file metadata and encrypted OAuth connection data | International processing under Google's API terms; SCCs or adequacy mechanism where required |
| Google Sign-In (Google LLC) | Authentication where enabled | Identity and contact information returned by Google | International processing under Google's authentication terms; SCCs or adequacy mechanism where required |
| Cloudflare, Inc. | Proxy, CDN, DNS, TLS and security services | IP address, request metadata and security signals | International processing; Cloudflare DPA/SCC terms apply where required |
| Cloudflare R2 | Encrypted infrastructure backup storage | Encrypted backup archives and infrastructure metadata | Selected EU R2 region |
| Cloudflare Turnstile | Abuse prevention and security | IP/device and challenge data | Only where enabled; international processing under Cloudflare DPA/SCC terms where required |
Research provider handling
CONSELA uses third-party web-research providers to process generated search queries and return public search results. Provider-specific terms and retention practices apply.
- Brave Search: API privacy notice
- Exa: privacy policy
- Tavily: privacy policy
Changes
We will update this page when adding or replacing a provider and will provide any notice required by the applicable DPA or law. Contact admin@consela.ai with questions.