Legal
Subprocessors
Services that process customer data on our behalf to run Arcus. Last updated October 24, 2026.
Always used
| Vendor | Purpose | Data it receives | Location |
|---|---|---|---|
| Railway Corporation | API hosting, PostgreSQL database, Redis cache | All customer data Arcus stores: account, org settings, encrypted connector credentials, cases, notes, transcripts, Case Memory, audit log. Encrypted at rest with AES-256, including volumes and backups | United States (US West) |
| Netlify, Inc. | Marketing website and docs hosting | Website visitor requests (IP address, browser details). No product data | United States / global CDN |
| Deepgram, Inc. | Speech-to-text for live call transcripts | Call audio while a call is transcribed (only if you use calls) | United States |
| Duck Duck Go, Inc. | Public web search used during investigations | Search queries Arcus builds from an investigation (may include error messages or product names from a ticket). No account data | United States |
| Stripe, Inc. | Payments and billing | Billing contact, plan and payment details (card data handled by Stripe only) | United States |
AI model providers: only the one you select
Each org picks its AI provider in settings. Only the selected provider receives your org’s AI requests (ticket text, logs, code snippets, transcripts and screenshots sent with each request), and only it is your subprocessor. Arcus enforces this in code. Arcus does not use your data to train models unless your admin opts in.
| Provider | Country | Status | Training and retention |
|---|---|---|---|
| Anthropic, PBC (Claude) | United States | Default | API data not used for training by default; zero data retention available for eligible accounts, otherwise limited retention for abuse monitoring |
| OpenAI, L.L.C. (GPT) | United States | If selected | API data not used for training by default; retained up to 30 days for abuse monitoring unless zero data retention is approved |
| X.AI Corp. (Grok) | United States | If selected | API data not used for training without permission; retained up to 30 days unless zero data retention is enabled; DPA at x.ai/legal/data-processing-addendum |
| Google LLC (Gemini) | United States | If selected | Paid API data not used to improve products; limited retention for abuse monitoring |
| Hangzhou DeepSeek AI (DeepSeek) | China(China-based) | Opt-in only | Processed and stored in the People’s Republic of China. DeepSeek’s API terms do not say API data is excluded from training. No EU adequacy decision for China. Enable only after admin opt-in |
| Moonshot AI (Kimi) | China (data stored in Singapore)(China-based) | Opt-in only | China-based company. Arcus uses the international platform (api.moonshot.ai), whose privacy policy says data is stored in Singapore and API data is not used for training. Enable only after admin opt-in |
China-based providers are off by default. An org admin must opt in explicitly, and the opt-in is recorded in the audit log. Orgs that have not opted in never have data routed to China, including as a fallback.
Bring your own key: if you connect your own provider key, that provider processes your data under your own contract with it, and it is not an Arcus subprocessor for that traffic.
Sign-in and connectors you choose
Google and GitHub sign-in, and connectors you add (Zendesk, ServiceNow, Jira, Slack, Intercom, Freshdesk, Salesforce, Zoom, calendars, PagerDuty, Datadog, Sentry, Confluence, Notion), are your own accounts used with the permissions you grant. They are not Arcus subprocessors.
Changes
We give at least 30 days’ notice before a new subprocessor starts processing customer data, and you may object. To get notified, email daarishlomo@gmail.com. See also the data processing addendum, privacy policy and security.