Sub-processors List

Last Updated: April 20, 2026

This page lists the third-party sub-processors that Smalt AI PLT ("Smalt AI") uses to process personal data on behalf of our customers. This list is maintained in accordance with our Data Processing Agreement (DPA).

 Change Notifications: We will update this page and notify customers at least 30 days before adding a new sub-processor. To receive notifications, ensure your account administrator's email is current, or subscribe to updates by emailing support@smaltai.com.

Current Sub-processors

Infrastructure & Hosting

Sub-processor	Purpose	Data Processed	Location
Amazon Web Services (AWS)	Cloud infrastructure, hosting, data storage, compute	All customer data (encrypted at rest and in transit)	United States / EU (configurable for enterprise)
Supabase	Authentication (email/password) and identity storage	Email, hashed password, account metadata	United States

AI Model Providers

Sub-processor	Purpose	Data Processed	Location
Anthropic (Claude)	AI language model for text generation, analysis, and reasoning	User prompts and conversation content (not retained by Anthropic for training)	United States
Google (Gemini)	AI language model for text generation and image/visual tasks	User prompts and conversation content (not retained by Google for training)	United States

Third-party Integrations & Data Providers

Sub-processor	Purpose	Data Processed	Location
Composio	Third-party tool integrations (e.g. Gmail, Outlook, Notion, Slack, Salesforce) via OAuth connections	OAuth tokens, tool metadata, and data exchanged with connected services when you execute a tool	United States
Apollo	Contact and company lookup (name, title, email, LinkedIn)	Search queries you submit (e.g. company name, job title); looked-up contact results	United States
Firecrawl	Web scraping and deep research on public websites	URLs and search queries you submit; scraped public web content	United States

Identity Providers (optional)

Sub-processor	Purpose	Data Processed	Location
Google (Sign-In with Google)	Single Sign-On (only if you choose to sign in with your Google account)	Email address, name, Google account identifier	United States

Payment Processing

Sub-processor	Purpose	Data Processed	Location
Stripe	Payment processing, subscription billing	Name, email, billing address, payment method tokens	United States

Email & Communication

Sub-processor	Purpose	Data Processed	Location
Amazon SES	Transactional email delivery	Email address, email content	United States
Resend	Email delivery service	Email address, email content	United States

Data Transfer Safeguards

For sub-processors located outside the UK/EEA, we ensure appropriate data transfer mechanisms are in place:

Standard Contractual Clauses (SCCs) as approved by the European Commission
UK International Data Transfer Addendum (IDTA) for UK-origin data
Data Processing Agreements (DPAs) with each sub-processor

How to Object to a New Sub-processor

Under our DPA, you have the right to object to the addition of a new sub-processor:

You will receive email notification at least 30 days before a new sub-processor begins processing data.
To object, send a written notice to support@smaltai.com within 14 days of notification.
We will work with you in good faith to address your concerns.
If we cannot resolve the objection, you may terminate the affected portion of the Service.

Change Log

Date	Change
April 20, 2026	Added Composio, Apollo, Firecrawl, and Supabase. Removed Google Analytics (no longer in use).
April 15, 2026	Initial publication of sub-processors list.

Contact

 Smalt AI PLT - Data Protection

Email: support@smaltai.com

Website: www.smaltai.com