Keygraph engages the third-party service providers listed below ("Subprocessors") in connection with the Keygraph Cloud Service. Each Subprocessor is contractually bound to data-protection obligations substantially equivalent to those applicable to Keygraph under the Keygraph Data Processing Agreement.
The Subprocessors listed below include both (a) Subprocessors that Process Customer Personal Data today in delivering the Cloud Service, and (b) Subprocessors authorized for future use without further notice. Customer's general authorization at the time of executing the Agreement extends to all Subprocessors listed below. Additions to or replacements of entries on this list are subject to the notice and objection procedure in the Data Processing Agreement.
Each Subprocessor is grouped by category:
This page is the authoritative source for Keygraph's current Subprocessor list. Keygraph updates this page whenever a Subprocessor is added or replaced.
This page is the authoritative source for Keygraph's current Subprocessor list. When Keygraph adds or replaces a Subprocessor entity, Keygraph notifies Customer's designated administrator by email in accordance with the notice procedure in the Data Processing Agreement (or the Standard Data Processing Terms, as applicable).
Customers may also email legal@keygraph.io with questions about the list or to confirm the current set of Subprocessors.
These Subprocessors Process Customer Content and operational data in delivering the Cloud Service. Where Customer has elected the EU Data Residency option, only EU-region facilities of these Subprocessors are used for Customer's tenant.
| Subprocessor | Purpose | Entity Location | EU Data Residency Option |
|---|---|---|---|
| Amazon Web Services, Inc. | Cloud hosting and infrastructure (primary) | USA (with EU regions available) | Yes — tenant data stored in AWS EU regions |
| Google Cloud Platform (Google LLC) | Cloud hosting and infrastructure (authorized for future use and specific services) | USA (with EU regions available) | Yes — EU regions used for EU-resident tenants where applicable |
| Microsoft Azure (Microsoft Corporation) | Cloud hosting and infrastructure (authorized for future use and specific services) | USA (with EU regions available) | Yes — EU regions used for EU-resident tenants where applicable |
| Cloudflare, Inc. | Global CDN, DNS, DDoS protection, edge security, and edge compute (Cloudflare Workers) | Global edge network | Edge traffic served globally from nearest POP; geographic data localization features available where configured by Provider |
| ClickHouse, Inc. | Real-time analytics and data warehousing | USA (with EU regions available) | Yes — EU regions used for EU-resident tenants |
| Temporal Technologies, Inc. | Workflow orchestration | USA (with EU regions available) | Yes — EU regions used for EU-resident tenants |
| Resend (Resend, Inc.) | Transactional email delivery (product notifications, alerts, account emails) | USA (with EU region available) | Yes — emails to recipients in the EEA are processed within Resend's EEA infrastructure |
| Stripe, Inc. | Payment processing (billing-instrument data only) | USA | Not applicable (billing-instrument data only) |
| Measure (formerly Maple Billing) | Billing, subscription management, and invoicing (billing contact and subscription data; no payment-instrument data) | USA | Not applicable (billing data only) |
Current architecture (BYOK): Today, AI features of the Cloud Service operate against large language model endpoints designated by Customer (Bring-Your-Own-Key, or "BYOK"). Customer selects and controls the provider and location of its LLM endpoint, and AI compute occurs in Customer's LLM tenant under Customer's account. Under the current BYOK architecture, the LLM provider Customer designates is Customer's direct vendor, not Keygraph's Subprocessor, and the entries in this category do not function as Keygraph's Subprocessors with respect to Customer Content processed through Customer's BYOK configuration.
Why these entries are listed: Keygraph may, in the future, introduce AI features that operate against Keygraph-managed LLM endpoints rather than Customer-designated endpoints (for example, features made available to free-tier or trial users, or features where BYOK is not technically feasible). The entries in this category are listed to authorize potential future use of these providers as Keygraph's Subprocessors without further notice. If and when Keygraph activates such use, Keygraph will publish updated documentation describing the change, and the relevant entry in this category will function as a Keygraph Subprocessor for the affected feature.
Current handling: Keygraph's handling of AI request and response data — including under the current BYOK architecture — is further described in Keygraph's Code Security Posture.
| Subprocessor | Purpose (if and when activated as Subprocessor) | Entity Location |
|---|---|---|
| Anthropic PBC | Large language model service | USA |
| OpenAI, L.L.C. | Large language model service | USA |
| OpenRouter, Inc. | LLM gateway and routing | USA |
| Fireworks AI, Inc. | LLM inference platform | USA |
These Subprocessors Process Personal Data of Customer's administrators, signers, billing contacts, and other business contacts — not Customer Content or Customer's end-user data. They are listed for transparency consistent with the general definition of "Subprocessor" under applicable data-protection laws.
| Subprocessor | Purpose | Entity Location |
|---|---|---|
| Attio, Inc. | Customer relationship management (CRM); processes Customer's business contact and account data | USA |
| Google LLC (Google Workspace) | Productivity and communications (email, calendar, documents); may contain Customer business contact data and Customer-related communications | USA |
| Amplitude, Inc. | Product analytics; processes Customer's product usage data and administrator/user identifiers | USA |
| Slack Technologies, LLC (a Salesforce company) | Internal communications; may contain Customer business contact data and support-related discussions | USA |
| Linear Orbit, Inc. | Internal issue tracking; may contain Customer-reported bug reports or feature requests | USA |
| Granola AI Inc. | Internal AI meeting notes; may contain Customer business contact data when Customer meetings are recorded | USA |
For customers with an executed Keygraph Data Processing Agreement, the right to object to new Subprocessors is governed by Section 3.1 of that agreement. For customers using the Keygraph Standard Data Processing Terms (available at keygraph.io/dpa), the right to object is governed by Section 3.3 of those terms.
Email legal@keygraph.io with questions about Keygraph's Subprocessor program, data-protection terms with specific Subprocessors, or to subscribe to update notifications.
Keygraph, Inc. | © 2026 All rights reserved. This page is updated regularly. For the most current information, refer to this URL directly.