Subprocessors
Effective 1 November 2026
On this page
Immersive Investments B.V. ("n8v", "we") uses the companies below to process personal data on behalf of our customers when we provide the n8v service. This page is Annex IV of our Data Processing Agreement and part of the information we publish under Article 28 of the EU Data Act.
We give at least 30 days' notice before we add or replace a subprocessor. Notice goes by email to the admins of every customer account and appears on this page. Customers can object during the notice period as described in section 3 of the Data Processing Agreement.
Status values: "Active" means the service is in use in production today. "When enabled" means the integration exists in our code but is switched off in production; we will announce it with 30 days' notice before we switch it on.
1. Subprocessors
| # | Entity | Purpose | Personal data involved | Location | Transfer mechanism | Status |
|---|---|---|---|---|---|---|
| 1 | Vercel Inc. (USA) | Hosting of the web application, public API and serverless functions; content delivery | All data that passes through the application; application logs | Functions run in Dublin, Ireland (region dub1); a move to Stockholm, Sweden (arn1) is under consideration. Static content is served from Vercel's global edge network. Platform metadata and logs may be stored in the USA | EU-US Data Privacy Framework (DPF); Standard Contractual Clauses (SCCs) in Vercel's DPA as fallback | Active |
| 2 | Hetzner Online GmbH (Germany) | Server hosting for our primary PostgreSQL database and its connection pooler | Everything stored in the database: account data, tasks, prompts, messages, agent outputs, settings, usage records, encrypted credentials | Helsinki, Finland (EU) | Not needed (EU) | Active |
| 3 | Cloudflare, Inc. (USA) | DNS, network security and access control; Web Analytics (page views and load times, without cookies); R2 object storage for task attachments, agent session checkpoints and database backups; Workers for independent monitoring; realtime service (PartyKit) for live updates and interactive terminal sessions; Email Routing, which forwards mail sent to our n8v.online addresses | Files you attach to tasks, agent session checkpoints, full database backups, realtime messages and terminal input and output in transit, email you send us in transit | Database backups: R2 bucket restricted to the EU jurisdiction. Attachments and session checkpoints: private R2 bucket with a Western Europe location hint, without a jurisdiction restriction. Network, realtime and email traffic: Cloudflare's global network | DPF; SCCs in Cloudflare's DPA as fallback | Active |
| 4 | FoundryLabs, Inc., trading as E2B (USA) | Isolated cloud sandboxes (microVMs) in which agents clone your repositories and run code, tests and tools | Repository contents, prompts, environment variables and secrets injected at runtime, agent outputs, terminal input and output, files created during tasks | Google Cloud region us-west1 (Oregon, USA), E2B's default region. E2B's EU region (europe-west1, Belgium) is available on its Pro plan on request and is not enabled for n8v | SCCs (Module 3) in E2B's DPA (offered on request; signature pending). We found no DPF certification for E2B | Active |
| 5 | Upstash, Inc. (USA) | Managed Redis for rate limiting and short-lived coordination state | User and sandbox identifiers, temporary OAuth state values, rate-limit counters. Kept for 24 hours or less | Global database. EU traffic is served through AWS endpoints in eu-central-1 (Frankfurt) or eu-west-1 (Ireland), US traffic through US endpoints such as us-west-2 (Oregon) | DPF (Upstash DPA, April 2025); SCCs as fallback | Active |
| 6 | PostHog, Inc. (USA), PostHog Cloud EU | Product analytics and error tracking, configured without cookies or local storage and without session recording | For signed-in users the user ID; page views and product events, browser and device type, IP address, error messages and stack traces | Frankfurt, Germany (AWS eu-central-1) | Stored in the EU. DPF, with SCCs as fallback, for any access from the USA | Active |
| 7 | OpenAI Ireland Ltd (Ireland) and its affiliates, including OpenAI OpCo, LLC (USA) | AI features we run under our own account: task titles, branch names, commit messages, pull request titles and descriptions, session summaries and voice transcription. Also model access when you pay for OpenAI models with n8v credits | The task context each feature needs (for example a code diff or message history), voice recordings, generated text | USA and other OpenAI locations. OpenAI's EU data residency is available per project and is not configured today | SCCs in OpenAI's DPA for transfers from OpenAI Ireland to its US affiliates | Active |
| 8 | Anthropic Ireland, Limited (Ireland) and Anthropic, PBC (USA) | Model access when you pay for Anthropic models with n8v credits | Prompts, code context, tool results, outputs | USA and other Anthropic locations | SCCs (Modules 2 and 3) in Anthropic's DPA | Active, under review |
| 9 | Google LLC (USA) | Gemini API model access when you pay for Google models with n8v credits | Prompts, code context, outputs | USA and other Google locations | DPF (Google LLC certification active); SCCs in Google's data processing terms as fallback | Active |
| 10 | OpenRouter, Inc. (USA) | Routing to models offered through OpenRouter when you pay with n8v credits | Prompts, code context, outputs, forwarded to the upstream model provider that serves the request | USA and the upstream provider's locations | SCCs, according to OpenRouter's privacy policy. OpenRouter offers a signed DPA only on its enterprise tier, which n8v does not have yet | Active, under review |
| 11 | Apple Inc. (USA) | Push notifications to the n8v iOS app through the Apple Push Notification service | Device token, notification text (task name and status), unread count | USA | SCCs, according to Apple's privacy policy | Active for users who allow notifications |
| 12 | Plus Five Five, Inc., trading as Resend (USA) | Sending service email from mail.n8v.online, such as sign-in links | Email address, name, message content | USA | DPF; SCCs in Resend's DPA | Active |
| 13 | Google LLC (USA), Gmail | The mailbox that receives mail sent to [email protected], [email protected], [email protected] and [email protected] after Cloudflare forwards it | Correspondence and attachments you send us | USA and other Google locations | DPF (Google LLC certification active) | Active |
| 14 | Stripe Payments Europe, Limited (Ireland) and Stripe, Inc. (USA) | Payments, subscriptions, invoices and VAT calculation (Stripe Tax) | Billing contact, company name, address, VAT number, payment metadata. Card details go directly to Stripe | EU and USA | DPF (Stripe, Inc.); SCCs as fallback | When paid plans launch. Stripe acts as an independent controller for its own fraud prevention and legal compliance |
| 15 | Loops (USA) | Onboarding and product email | Email address, name, onboarding status | USA | Set before it is enabled, and stated in the notice | When enabled |
| 16 | Daytona (USA) | Alternative sandbox provider | Same as row 4 | Set before it is enabled, and stated in the notice | Set before it is enabled, and stated in the notice | When enabled |
Notes:
- Model providers in rows 7 to 10 receive your content only in the situations described in the purpose column. OpenAI, Anthropic and Google may not use it to train models under the terms we use them on. OpenRouter forwards each request to an upstream provider under that provider's terms; we do not yet restrict it to providers that exclude training on inputs.
- Our internal operations alerts (database health, backup status) are sent to our own operator through Telegram. They contain system health information only, never customer content.
2. Services you connect (not subprocessors)
When you connect one of the services below, you instruct us to exchange data with it on your behalf. The provider processes that data under your own agreement with it, not under our Data Processing Agreement, and you are responsible for complying with its terms.
| Service | What happens when you connect it |
|---|---|
| GitHub (GitHub, Inc.) | You sign in with your GitHub account. Our GitHub App reads and writes the repositories you select during installation: it clones code into sandboxes, pushes branches and commits, opens pull requests and reads checks and review comments. GitHub is also an independent controller of your sign-in data. |
| Slack | Our Slack app receives the messages you address to it and posts task updates and replies in your workspace. |
| Telegram | Our Telegram bot sends task notifications (task name, repository, status, links) to the chat you link and accepts commands from it. Messages pass through Telegram's servers. |
| Plane | Agents read and update work items in the Plane workspace you connect, whether self-hosted or on Plane Cloud. |
| Gmail (Google) | With your authorization, agents read the messages you point them to and create or update drafts. They do not send email. Our use of Google user data follows the Google API Services User Data Policy, including the Limited Use requirements (see the privacy notice). |
| MCP servers | Agents call the Model Context Protocol servers you configure, with the credentials you provide. |
| Your own model provider accounts or API keys | If you connect your own account or key (for example Anthropic, OpenAI, Google, xAI, OpenRouter or Sourcegraph Amp), requests go to that provider under your agreement with it. The provider is your vendor, not ours. |
| Your API clients and webhook endpoints | Data you request through our API, and events we deliver to the webhook URLs you register, go to systems you control. |
Experimental third-party models are not offered under our Data Processing Agreement. Some preview models are run by operators who keep prompts and outputs, and in some cases the operator is anonymous. We only make such a model available to an account after an explicit opt-in that names this risk, and we recommend against using them with code or data that contains personal data or confidential information.
3. Where our infrastructure is and who can compel access (Data Act, Article 28)
- Our primary database runs in Finland and its backups are stored in a bucket restricted to the EU jurisdiction. Our application functions run in Ireland (a move to Sweden is under consideration) and product analytics are stored in Germany.
- Agent sandboxes run in the USA today (E2B's default region, Google Cloud us-west1). E2B offers an EU region (europe-west1, Belgium) on its Pro plan on request; it is not enabled for n8v, and no date for a move is set. E2B keeps paused sandboxes until they are explicitly deleted, so we delete them ourselves, as described in Annex II of the Data Processing Agreement.
- Several of our providers are companies established in the USA. Data they process can be subject to US laws that allow public authorities to request access, even when the data is stored in the EU.
- To prevent unlawful governmental access to or transfer of non-personal data held in the EU, we: encrypt all traffic in transit; store credentials and secrets encrypted at the application layer, with a key that is not stored with the database; keep the database and its backups in the EU; disclose customer data to authorities only when a binding legal obligation requires it, after checking its validity and scope; and inform the affected customer before disclosure unless the law forbids it.
4. Changes to this list
| Date | Change |
|---|---|
| 1 November 2026 | First version. |
| 1 November 2026 | Cloudflare: Web Analytics added to the purposes. PostHog: receives the user ID only, no longer name and email. |