Back to home

Security

Subprocessors

Every service Xyranik can send a workspace’s data to, what each one receives, and what turns it on. A service is used only when its configuration is set, so a given deployment may use fewer than are listed here; none is used that is not.

Last updated: 7 October 2026. This list is read from the product’s own configuration and checked against it on every build, so a service added to the product joins this page in the same change.

Running the service

Used for every workspace, whenever the service runs.

  • Vercel, Inc.

    Application hosting and scheduled jobs

    Runs the application and its background work.

    • Account holders: name, sign-in address
    • Contacts: addresses, numbers, names, consent records
    • Message contents and delivery receipts
    • Orders: buyer address, amounts, dates
    • Content to publish, and what it did
    • Usage counts and request metadata

    Mumbai, India (region bom1), as configured in vercel.json

  • MongoDB, Inc. (Atlas)

    Database

    Holds every workspace’s records.

    • Account holders: name, sign-in address
    • Contacts: addresses, numbers, names, consent records
    • Message contents and delivery receipts
    • Orders: buyer address, amounts, dates
    • Content to publish, and what it did
    • Usage counts and request metadata

    —

  • Supabase, Inc.

    Sign-in and file storage

    Authenticates account holders and stores uploaded pictures and video.

    • Account holders: name, sign-in address
    • Content to publish, and what it did

    —

  • OpenAI, L.L.C.

    AI models

    Writes drafts, reads a business’s website, answers questions and runs agents, from prompts with personal data masked.

    • Content to publish, and what it did
    • Usage counts and request metadata

    —

  • Google LLC (Gemini models)

    AI models

    The same work as above, on the other configured provider, from prompts with personal data masked.

    • Content to publish, and what it did
    • Usage counts and request metadata

    —

  • Upstash, Inc.

    Rate limiting

    Counts requests per account so nobody can flood the service. Holds a counter per account id, nothing else.

    • Usage counts and request metadata

    —

  • Functional Software, Inc. (Sentry)

    Error reporting

    Receives error reports from the application, scrubbed of personal data before they leave; no session replay is recorded.

    • Error reports, with personal data scrubbed

    —

On a workspace’s instruction

Used only when a workspace connects the service or asks for the action: a send, a payment, a connected store or account.

  • Stripe, Inc.

    Billing

    Takes payment for plans and credit packs.

    • Account holders: name, sign-in address
    • Billing: the paying account and amounts, never card numbers

    —

  • Twilio Inc. (SendGrid)

    Email delivery

    Sends the emails a workspace asks for and reports their delivery.

    • Contacts: addresses, numbers, names, consent records
    • Message contents and delivery receipts

    —

  • Twilio Inc.

    Text and WhatsApp delivery

    Sends the texts a workspace asks for, outside India, and reports their delivery.

    • Contacts: addresses, numbers, names, consent records
    • Message contents and delivery receipts

    —

  • MSG91 (Walkover Web Solutions Pvt. Ltd.)

    Text delivery in India

    Sends the texts a workspace asks for to Indian numbers, under the telecom registration, and reports their delivery.

    • Contacts: addresses, numbers, names, consent records
    • Message contents and delivery receipts

    India

  • Runway AI, Inc.

    Video generation

    Makes the video shots a workspace asks for, from a brief.

    • Content to publish, and what it did

    —

  • Google LLC (Veo video models)

    Video generation

    Makes the video shots a workspace asks for, from a brief, on the other configured video provider.

    • Content to publish, and what it did

    —

  • An S3-compatible object store the operator chooses (Cloudflare, Inc. R2 recommended)

    Media storage

    Holds uploaded pictures and video in a public bucket, so the platforms a workspace publishes to can fetch them. Used instead of the sign-in provider’s storage when configured.

    • Content to publish, and what it did

    —

  • X Corp.

    X (Twitter)

    Publishes posts on an account a workspace connected.

    • Content to publish, and what it did
    • Usage counts and request metadata

    —

  • Google LLC (YouTube)

    YouTube

    Publishes video on a channel a workspace connected, under the same Google client as the advertising connection below.

    • Content to publish, and what it did
    • Usage counts and request metadata

    —

  • Meta Platforms, Inc.

    Facebook and Instagram

    Publishes posts and reads their results, and reads ad spend, on accounts a workspace connected.

    • Content to publish, and what it did
    • Usage counts and request metadata

    —

  • Google LLC (Google Ads)

    Advertising

    Reads ad spend and changes budgets on accounts a workspace connected.

    • Usage counts and request metadata

    —

  • LinkedIn Corporation

    LinkedIn and LinkedIn Ads

    Publishes posts and reads ad spend on accounts a workspace connected.

    • Content to publish, and what it did
    • Usage counts and request metadata

    —

  • Shopify Inc.

    Store orders

    Sends a connected store’s orders to the workspace. Data flows in, not out: Xyranik verifies and receives.

    • Orders: buyer address, amounts, dates

    —

Configured for, not used

The configuration also carries settings for integrations whose code is in the product but which no workspace is offered: TikTok, Amazon Ads, Spotify Ads, Pinterest, Snapchat. Nothing is sent to them. Configuration is not the same as use, and this page says which is which.

What this list does not say

Where the location column is blank, the service decides where it processes, or the operator chose it when configuring the deployment; Xyranik does not pin it. Whether an AI model provider retains a prompt, and for how long, is a term of that provider’s own agreement, which this page does not restate. What Xyranik does is mask personal data in every prompt before it leaves. For the full picture of how personal data is handled, read how Xyranik processes personal data. Questions, or notice of a change you need: support@xyranik.com.