Subprocessors
Effective 8 October 2026
These are the third parties that Anterra Ltd uses to host and run Weave and that may process personal data or Customer Content on our behalf. Each is bound by a written contract with data protection terms equivalent to those in our Data Processing Addendum.
1. Current subprocessors
| Subprocessor | Purpose | Data processed | Location | Transfer mechanism |
|---|---|---|---|---|
| Google Cloud (Google LLC) | Hosts the Weave server (Cloud Run), its Postgres database with vector search (Cloud SQL), repository files and uploaded images (Cloud Storage), event messaging (Pub/Sub), infrastructure secrets (Secret Manager), container images (Artifact Registry) and server logs (Cloud Logging). | Customer Content, search index, operation log, avatar images, server logs (incl. IP addresses) | USA (us-central1, Iowa) for the Weave server and its database; EU multi-region for repository files and images (Cloud Storage) | Data Privacy Framework (EU–US and UK Extension); EU SCCs + UK Addendum in provider DPA (Cloud Data Processing Addendum) |
| Vercel Inc. | Hosts the web platform at www.weave.directory and its serverless functions; edge network; request and function logs. | All platform data in transit, server logs (incl. IP addresses) | USA and global edge network | EU SCCs + UK Addendum in provider DPA (Vercel DPA); Data Privacy Framework [TO CONFIRM: Vercel DPF certification] |
| Prisma Data, Inc. (Prisma Postgres) | Hosts the platform database: accounts, organisations, memberships, credentials (hashed/encrypted), billing records, rate-limit counters. | Account, organisation, security and billing data | [TO CONFIRM: Prisma Postgres region] | [TO CONFIRM: Prisma DPA and transfer mechanism] |
| Resend (Plus Five Five, Inc.) | Sends transactional email (welcome, password reset, verification, invitations, notifications) and delivers contact-form messages to us. | Name, email address, email content | USA | EU SCCs + UK Addendum in provider DPA [TO CONFIRM: Resend DPA signed; DPF status] |
| OpenAI, L.L.C. / OpenAI Ireland Ltd | Creates embeddings for semantic search and impact prediction, and answers resolve requests (chat completion). | Symbol names, docstrings, decision-thread text, search queries and intents | USA | EU SCCs + UK Addendum in provider DPA (OpenAI DPA) [TO CONFIRM: OpenAI DPA executed; contracting entity] |
| Stripe Payments Europe Ltd / Stripe, Inc. | Payment processing for paid features, when enabled. Stripe acts as an independent controller for its own fraud-prevention and regulatory purposes. | Name, email, billing details, payment card data (held only by Stripe) | Ireland and USA | Data Privacy Framework; EU SCCs + UK Addendum in provider DPA (Stripe DPA) |
| [TO CONFIRM: email/mailbox provider for privacy@, security@ and contact-form messages] | Receives and stores emails sent to us. | Name, email address, message content | [TO CONFIRM: location] | [TO CONFIRM: mechanism] |
2. Services you choose to connect
These are not our subprocessors. They act as independent controllers, or under your own agreement with them, when you choose to use them:
- GitHub and Google sign-in (if offered): the provider authenticates you and shares your basic profile with us.
- Your own AI provider used by
weave enrichin the CLI (Anthropic, OpenAI or Google Gemini with your API key): code is sent from your machine straight to that provider. - Webhook endpoints you configure for a repository.
3. Alternative AI providers
The Weave server supports Google Gemini and Anthropic as alternatives to OpenAI. They are not currently used by the hosted service. If we switch, we will add them here and notify customers first.
4. Changes to this list
We will update this page at least 30 days before a new subprocessor starts processing Customer Content (except in an emergency affecting the security or availability of the Service), and will notify business customers who have a Data Processing Addendum with us by email. Customers may object on reasonable data protection grounds as set out in the Addendum. To request the Addendum or to subscribe to change notices, email privacy@weave.directory. See also our Privacy Policy.