List of Sub-Processors
Last updated 12 October 2026
Chat Thing engages with a number of Sub-Processors to support our infrastructure and the normal running of the platform. By agreeing with our DPA, you agree all of these Sub-Processors may have access to Customer Data.
| Third Party Sub-Processor | Purpose | Applicable Service | Place of processing |
|---|---|---|---|
| Supabase Inc - DPA | Hosting & Infrastructure | Used as primary database storage, file storage and authentication systems. | United States |
| Railway | Hosting & Infrastructure | On demand cloud computing and APIs | United States |
| Cloudflare | Content Delivery Network | Web infrastructure and web site security including domain name server services, DDoS protection, content delivery network, and SSL certificates | United States |
| OpenRouter | AI APIs | Routes bot messages to the model provider you select (OpenAI, Anthropic, Google and others). Also works out which sources an answer used, where a bot shows sources (see below). | United States |
| Open AI | AI APIs | Speech-to-text and text-to-speech for the web chat's voice features. Only used where a bot has voice enabled. | United States |
| Nylas | Email Connectivity | Optional. Only where you connect an email account to a bot: sends and receives mail on that account's behalf. Not used unless you connect one. | United States |
| Stripe | Payment Processor | Collection and processing of customer payments and subscriptions | United States |
| Plausible | Web Analytics | Web analytics and usage statistics | Germany |
| Posthog | Web analytics | Web analytics and usage statistics and A/B testing | Germany |
| ConvertKit | Marketing Emails | Email notifications and marketing emails testing | United States |
How bot messages reach AI providers
Bot messages reach the underlying AI models through OpenRouter, which routes each request to the model provider you have selected for that bot. Where a bot has voice enabled, audio is sent to OpenAI's API directly for speech-to-text, and reply text is sent for text-to-speech; that path does not go through OpenRouter.
How a bot works out which sources it used
Where a bot has Include sources for responses turned on, Chat Thing shows only the sources an answer actually used. To work that out, once the bot has written its answer we send the following to Jev, a model from TypeSafe, through OpenRouter:
- the customer's message
- the bot's answer
- the knowledge-base passages retrieved for that answer
- the results of any power-ups the bot used in that answer
This runs on Chat Thing's own OpenRouter account, including for teams that use their own AI provider key. It applies to answers in the web chat, streamed replies from the API channel, and MCP. It is not used for Slack, Discord, WhatsApp, Telegram, email or phone conversations. Bots with Include sources for responses turned off send nothing to Jev.
Each provider handles data under its own terms, linked in the table above. See our Privacy Policy for how Chat Thing handles Customer Data.