Legal
Subprocessors
These are the third-party services we use to operate Recursiv. Each one is bound by contract to protect your data with safeguards no less protective than ours.
How to read this list
A subprocessor is a third party we use to process customer data in providing the Service. We name each subprocessor, the purpose, and the region where data is processed. Where a subprocessor is part of the Service, you may need it to use the corresponding feature; alternatives may be available on enterprise plans.
Hosting and infrastructure
Cloudflare, Inc. (United States and global edge): CDN, edge compute, R2 object storage, DNS, DDoS protection and network security. Coolify (self-hosted, EU): application deployment and orchestration. The hosting layer carries customer-app traffic and stored app data.
Databases and storage
Postgres (managed; region varies by customer plan): primary relational database for platform and per-app data. Cloudflare R2 (United States and global edge): object storage for uploads, attachments, generated artifacts and backups.
AI and inference providers
Anthropic PBC (United States): Claude models for chat, agents and document parsing. Google LLC (United States): Gemini models. OpenAI, LLC (United States): GPT models. Customer prompts and uploaded files are sent to the chosen provider only when a feature explicitly invokes it. None of these providers train on customer content under our agreements.
Integrations and tooling
Composio (United States): brokered OAuth and API integrations between agents and third-party services (Gmail, Slack, GitHub, etc.). E2B (United States): ephemeral sandbox environments for code execution. Browser Use (United States): headless browser automation for QA, screenshots and agent web actions.
Payments
Stripe, Inc. (United States): payment processing, subscriptions, invoicing and tax. Stripe receives only the data necessary to bill (card details, billing address, tax info) and is itself PCI-DSS Level 1 certified.
Authentication and security
Better Auth (self-hosted): authentication primitives running within Recursiv’s own infrastructure; no separate vendor processes credentials. Optional OAuth providers (Google, GitHub, etc.) only when a customer connects them.
Communications
Resend (United States) or equivalent: transactional email (verification, password reset, billing notices). Used for system messages only; no marketing without separate consent.
Analytics and observability
PostHog (self-hosted or cloud, United States): product analytics, feature flags and session replay where enabled. Identifiable events are tied to your account only when necessary for product or security purposes.
Updates to this list
We update this page when we add, remove, or change subprocessors that handle customer personal data in the Service. Material changes are also announced in the product and by email to customers subject to the Data Processing Addendum at least 30 days before they take effect.
Contact
Questions about this list can be sent to [email protected].