Subprocessors
Keygraph engages the third-party service providers listed below ("Subprocessors") in connection with the Keygraph Cloud Service. Each Subprocessor is contractually bound to data-protection obligations substantially equivalent to those applicable to Keygraph under the Keygraph Data Processing Addendum or other applicable data processing agreement or addendum.
How to Read This Page
The Subprocessors listed below Process Customer Personal Data in delivering the Cloud Service. Customer's general authorization at the time of executing the Agreement extends to all Subprocessors listed below. Additions to or replacements of entries on this list are subject to the notice and objection procedure in the applicable DPA.
Each Subprocessor is grouped by category:
- Category A: Infrastructure and Core Service lists Subprocessors that Process Customer Content and operational data in delivering the Cloud Service.
- Category B: Support and Troubleshooting lists Subprocessors that Process Customer Content only when Customer initiates support or troubleshooting communications, not Customer Content stored in the Cloud Service tenant.
The Cloud Service operates on a Bring-Your-Own-Key (BYOK) basis for AI features; as explained under "AI Processing" below, the customer-designated LLM service provider or gateway operator is the customer's vendor and not a Keygraph Subprocessor.
(Note: Third-party service providers used for Keygraph's internal business operations, such as payment processing, CRM, and billing, act as our processors, with Keygraph acting as the Data Controller. Because they do not process Customer Content, they are not Subprocessors under the DPA and are not listed here. For information on how we handle account and billing data, please see our Privacy Policy.)
Stay Informed
This page is the authoritative source for Keygraph's current Subprocessor list. How customers receive notice of changes depends on the agreement under which they use the Cloud Service:
- Customers with a separately signed data processing agreement or addendum receive notice and may object to new Subprocessors in accordance with that signed agreement or addendum.
- Customers using the Keygraph Data Processing Addendum (available at keygraph.io/dpa) can monitor this page directly. In accordance with Section 3.2 of the Standard DPA Terms, this page is updated at least ten (10) business days before a new Subprocessor entity begins Processing Customer Personal Data, and is the authoritative source for the current list. The right to object to a new Subprocessor is governed by Section 3.3 of the Standard DPA Terms.
In either case, Customer may email legal@keygraph.io to confirm the current list or ask questions about Keygraph's Subprocessor program.
Category A: Infrastructure and Core Service Subprocessors
These Subprocessors Process Customer Content and operational data as part of delivering the Cloud Service. Where Customer has elected the EU Data Residency option, Keygraph's residency commitment is limited to Customer Content stored at rest in the production tenant database and object storage of the Cloud Service, as described in the Agreement and DPA. Other processing, including account metadata, billing data, support communications, security telemetry, Usage Data, Operational Telemetry, operational logs, personnel access, edge/CDN/security processing, transactional email, Customer-selected Third-Party Services, and Customer AI Providers, is governed by the Agreement and DPA.
Cloud Hosting: Keygraph provisions Customer tenants on Amazon Web Services (AWS).
| Subprocessor | Purpose | Entity Location | EU Data Residency Option |
|---|---|---|---|
| Amazon Web Services, Inc. | Primary cloud hosting and infrastructure | USA (with EEA regions available) | Yes: Customer Content stored at rest in the production tenant database and object storage is stored in Amazon Web Services regions located within the EEA |
| Cloudflare, Inc. | Global CDN, DNS, DDoS protection, edge security, and edge compute (Cloudflare Workers) | Global edge network | Not covered by the EU Data Residency storage commitment; edge routing and DDoS mitigation may temporarily process traffic globally to ensure availability and security, relying on standard international transfer mechanisms. |
| Resend (Resend, Inc.) | Transactional email delivery (product notifications, alerts, account emails) | USA (with EEA region available) | EEA region used for transactional email processing for EU Data Residency tenants where available; not part of the EU Data Residency storage commitment for Customer Content stored in the Cloud Service production tenant database and object storage |
Category B: Support and Troubleshooting Subprocessors
These Subprocessors do not Process Customer Content stored in the Cloud Service tenant in the ordinary course. They Process Customer Content only in connection with support or troubleshooting, whether because Customer initiates a support communication (e.g., by emailing support, opening a ticket, or sharing content in a support channel) or because Keygraph support personnel handle or escalate that communication internally. For these Subprocessors, processing follows the global service of the Subprocessor and is not constrained by the EU Data Residency election.
| Subprocessor | Purpose | Entity Location |
|---|---|---|
| Plain (Plain Inc.) | Customer support and ticketing system (processes Customer Content only if submitted by Customer for support or troubleshooting purposes) | UK / USA |
| Google LLC (Google Workspace, including Gmail, Drive/Docs, Google Meet, and Gemini where enabled) | Corporate email, document hosting, video meetings, and AI-assisted support workflows such as summarizing, drafting, triaging, or analyzing support communications (processes Customer Content only if submitted by Customer for support or troubleshooting purposes or included by Keygraph support personnel in internal support handling) | USA / global |
| Slack Technologies, LLC (a Salesforce company) | Customer support communications and alerting via shared channels (processes Customer Content only if submitted by Customer for support or troubleshooting purposes) | USA |
| Linear Orbit, Inc. (Linear) | Internal issue tracking for support escalations (processes Customer Content only if included by Keygraph support personnel in an escalation ticket) | USA |
AI Processing: Bring-Your-Own-Key (BYOK)
The Keygraph Cloud Service operates on a Bring-Your-Own-Key (BYOK) basis for AI features. Customer's BYOK configuration controls the LLM service provider, gateway operator, credentials, account, and provider-side settings, but not each individual prompt, request, context item, tool output, or data element transmitted by the Cloud Service during ordinary operation. Keygraph transmits prompts, responses, code snippets, findings, retrieved context, and related operational metadata to the customer-designated LLM service provider or gateway operator as reasonably necessary to deliver the configured AI feature. Those providers are Customer's vendors, not Keygraph Subprocessors, and no Customer Content is routed to any Keygraph-engaged AI provider. Accordingly, there are no AI Subprocessors to list for Cloud Service AI features. This AI Processing section does not limit the Category B support and troubleshooting Subprocessors that Keygraph may use for customer-initiated support communications.
Customer Right to Object
For customers with a separately signed data processing agreement or addendum, the right to object to new Subprocessors is governed by that signed agreement or addendum. For customers using the Keygraph Data Processing Addendum (available at keygraph.io/dpa), the right to object is governed by Section 3.3 of the Standard DPA Terms.
Questions
Email legal@keygraph.io with questions about Keygraph's Subprocessor program or to confirm the current list of Subprocessors.
Keygraph, Inc. | © 2026 All rights reserved. This page is updated regularly. For the most current information, refer to this URL directly.
Last Updated: September 22, 2026