Sub-processors
open session Inc. uses the service providers below ("Sub-processors") to run BOS. Each processes personal information or Customer Content to provide its service to us, under written terms that limit its use of that information to providing the service and that include confidentiality, use, retention, and onward-transfer restrictions. These terms are in our contract with each provider or, for the default AI model hosts, in our AI gateway’s terms with its providers. Transfers rely on the standard contractual clauses in each provider’s data processing terms; where a provider is certified under the EU-U.S. Data Privacy Framework, the certification is an additional safeguard. This schedule forms part of our Terms of Service and our Data Processing Addendum. Capitalized terms not defined in this schedule have the meanings given in the Terms of Service and the Data Processing Addendum. If this schedule conflicts with the Data Processing Addendum, the Data Processing Addendum controls.
Customer-selected Connected Services are not Sub-processors. Data comes from those services into BOS at the Customer's direction, as described in Section 6 of the Privacy Policy. A provider of a Connected Service appears separately below only if it also receives data as an AI model hosting provider. Advertising platforms that receive information through marketing cookies on bos.live, while they are on for a visitor, are not Sub-processors either: they never receive Customer Content, and Section 5 of the Privacy Policy describes what they receive.
What each Sub-processor does
| Sub-processor | Service | Personal information | Location and transfer safeguard |
|---|---|---|---|
| Supabase Pte. Ltd. | ServiceDatabase, sign-in (auth.bos.live), and file storage | Personal informationAll account and Workspace data | Location and transfer safeguardUnited States (AWS us-west-2); Supabase data processing addendum (Version 1, August 1, 2026), incorporated in its terms, with standard contractual clauses (Modules 2 and 3), the UK Addendum, and Swiss terms |
| Railway Corporation | ServiceHosting for our API and background workers | Personal informationData the API processes; logs | Location and transfer safeguardUnited States; Railway data processing addendum (signed October 2026); EU-U.S. Data Privacy Framework, UK Extension, and Swiss-U.S. Data Privacy Framework, with standard contractual clauses as a fallback |
| Vercel Inc. | ServiceHosting for bos.live and app.bos.live; cookieless measurement | Personal informationRequests, page addresses, IP addresses | Location and transfer safeguardUnited States (Washington, D.C.) and global edge network; Vercel data processing addendum (March 31, 2026), incorporated in its terms, with standard contractual clauses, the UK Addendum, and Swiss terms; Data Privacy Framework certified |
| Google LLC | ServiceWebsite analytics on bos.live (Google Analytics 4), as Section 5 of the Privacy Policy describes | Personal informationPage views, approximate location derived from IP address, browser and device details | Location and transfer safeguardGoogle facilities worldwide; Google Ads Data Processing Terms (accepted September 17, 2025), with data sharing with Google products and services turned off; EU-U.S., UK, and Swiss Data Privacy Framework and standard contractual clauses |
| Consent Management Inc. d/b/a Inth (San Francisco, California) | ServiceHosting of the c15t consent banner on bos.live | Personal informationConsent choices, IP address | Location and transfer safeguardUnited States; Inth data processing addendum (signed October 26, 2026), with standard contractual clauses (Module 2) and the UK Addendum |
| Cloudflare, Inc. | ServiceNetwork and content delivery in front of app.bos.live; object storage (Cloudflare R2) for the asset library | Personal informationRequests, IP addresses; imported and uploaded media | Location and transfer safeguardGlobal edge network, with R2 storage in the United States; Cloudflare Customer DPA (v6.4, April 3, 2026), incorporated in its terms, with standard contractual clauses (Modules 2 and 3), the UK Addendum, and Swiss terms; Data Privacy Framework certified |
| OpenRouter, Inc. | ServiceAI gateway: routes model requests, embedding requests where embedding-based search is enabled for a Workspace, and the assistant’s web-search requests to the providers listed below, restricted to zero-retention endpoints in the United States or the European Union, with training endpoints disabled and prompt logging off, so that the gateway keeps no request content | Personal informationPrompts, chat history, attachments, document text, tool results, brand context | Location and transfer safeguardUnited States (Google Cloud); OpenRouter data processing addendum (August 26, 2026), incorporated in its terms, with standard contractual clauses (Module 2), the UK Addendum, and Swiss terms |
| Default AI model hosts reached through OpenRouter: Anthropic, PBC; OpenAI OpCo, LLC; Google LLC (Vertex AI) | ServiceRun the models that generate responses, names, descriptions, and tags, structure documents, and extract colors and themes, and, where embedding-based search is enabled for a Workspace, create embeddings. The assistant’s web search runs through these providers’ own search tools. Any other host that a customer asks us to enable is named in that customer’s Order | Personal informationThe requests the AI gateway routes to these providers. Each provider’s terms prohibit training on the requests and provide for zero retention, except that Google (Vertex AI) may keep requests for up to thirty (30) days for abuse monitoring and search queries are kept for no more than thirty (30) days | Location and transfer safeguardUnited States and the providers’ regions; each provider’s terms flow down to us under OpenRouter’s terms; transfers rely on OpenRouter’s standard contractual clauses and the providers’ own transfer terms |
| PostHog, Inc. | ServiceProduct analytics, session recording, and error capture on app.bos.live and bos.live | Personal informationUsage events and recordings that do not include Customer Content or text typed into forms, IP address, account identifier, role | Location and transfer safeguardUnited States (PostHog US Cloud); PostHog data processing addendum (signed October 2026); EU-U.S. Data Privacy Framework, UK Extension, and Swiss-U.S. Data Privacy Framework, with standard contractual clauses (Module 2), the UK Addendum, and Swiss terms |
| Mistral AI SAS | ServiceText extraction from uploaded PDFs and images | Personal informationFull contents of the files sent for extraction, used only to return the extracted text. Files are not retained after the text is returned, and training on our data is turned off | Location and transfer safeguardFrance (European Union); Mistral data processing addendum (July 27, 2026), incorporated in its terms, with standard contractual clauses (Module 4) |
| Langfuse GmbH, part of ClickHouse | ServiceAI request tracing for debugging | Personal informationRequest metadata only, with prompt and output text masked, deleted after thirty (30) days | Location and transfer safeguardUnited States (AWS us-west-2); ClickHouse data processing addendum (April 10, 2026), incorporated in its terms, with standard contractual clauses (Modules 2 and 3), the UK Addendum, and Swiss terms |
| Sampark, Inc. d/b/a Composio | ServiceConnections to the third-party apps that a Workspace enables, including the sign-in tokens for them | Personal informationSign-in tokens for connected apps and the requests and results exchanged with them, with zero data retention enabled | Location and transfer safeguardUnited States (AWS us-east-1); Composio data processing addendum (accepted October 25, 2026), with standard contractual clauses (Modules 2 and 3), the UK Addendum, and Swiss terms |
| Plus Five Five, Inc. d/b/a Resend | ServiceSign-in, service, and notification email, and open and click measurement of emails other than sign-in, security, and account emails | Personal informationEmail addresses, message content, opens and clicks | Location and transfer safeguardUnited States; Resend data processing addendum, pre-signed and incorporated in its terms, with standard contractual clauses, the UK Addendum, and Swiss terms; EU-U.S. and UK Data Privacy Framework |
| Stripe, LLC | ServicePayment processing for paid plans (billing only) | Personal informationBilling contact details, plan and billing records, and payment card details, which Stripe collects directly | Location and transfer safeguardUnited States; Stripe data processing addendum (September 28, 2026), incorporated in its terms; EU-U.S., UK, and Swiss Data Privacy Framework, with standard contractual clauses and the UK Addendum |
Upcoming Sub-processors
These providers will start handling personal information on the date shown, and not before. An upcoming provider may begin on its stated activation date without a further notice only if this schedule, at the time you accepted our Terms of Service, identified its legal entity, described its service and the categories of personal information it receives completely, confirmed its location and transfer mechanism, and stated a firm activation date. Otherwise, and whenever the provider, its scope, its location, its transfer mechanism, or its activation date materially changes, the notice period below applies before it begins.
| Sub-processor | Service and personal information | Location and transfer safeguard | Activation date |
|---|---|---|---|
| None at the date of this schedule | Service and personal information– | Location and transfer safeguard– | Activation date– |
How we tell you about changes
We add a new Sub-processor to this schedule at least thirty (30) days before it starts handling personal information, and we email Workspace owners at the same time, except that, where a Sub-processor must be replaced urgently to keep BOS secure or available, we make the change at once and give notice as soon as practicable. An AI model hosting provider that we enable only at a customer's request is named in that customer's Order, is a Sub-processor for that customer only, and is not added to this schedule. Anyone else can ask to be notified by emailing privacy@opensession.co with the subject "Sub-processor updates." This does not apply to Sub-processors already handling personal information when you accept our Terms of Service, and an upcoming provider is covered by the rule stated above. If you object to a change, tell us within the notice period and we will work with you on it as our Data Processing Addendum describes.
Change log
| Date | Change |
|---|---|
| October 27, 2026 | ChangeSchedule published. Replaces the sub-processor list in the Privacy Policy effective August 19, 2026. |
| October 28, 2026 | ChangePostHog updated to cover bos.live, for visitors who accept analytics there; Google (website analytics on bos.live) and Resend (email measurement) updated. No new Sub-processor, and no change to the Customer Content any provider receives. |
| October 29, 2026 | ChangeOn bos.live, PostHog and Google (website analytics) now run by default for visitors outside the European Economic Area, the United Kingdom, Switzerland, and Quebec, until they decline; in those regions, only after the visitor accepts. No new Sub-processor, and no change to the Customer Content any provider receives. |
| October 29, 2026 | ChangeFunctional Software, Inc. d/b/a Sentry (error monitoring) removed. Errors in app.bos.live are reported only to PostHog, whose error capture was already listed. No new Sub-processor, and no change to the Customer Content any provider receives. |