Sub-processors
LAST UPDATED · September 2026
This is the register referenced by our Data Processing Agreement. It lists every third party that may process customer data on Knull's behalf, together with what it is used for. It is maintained in the product rather than supplied on request.
Core sub-processors
These are engaged for every Knull account. The service cannot be delivered without them.
| Sub-processor | Purpose | Data involved | Processing region |
|---|---|---|---|
| Supabase (managed Postgres, Auth, Storage) | Primary database, authentication, file storage | Account details, workspace content, generated artefacts, audit and receipt records | EU / US (project region) |
| Cloudflare Workers | Application hosting and server execution | Request metadata in transit; no durable storage | Global edge |
| Anthropic | Primary model provider for generation and reasoning | Prompt content you or your agents submit; no training on API data | US |
| OpenAI | Reasoning and computer-use tier | Prompt content for those specific tasks | US |
| Stripe | Payments, subscriptions, payouts | Billing name, email, card token, transaction records | US / EU |
| Resend | Transactional email (invoices, briefs, approvals, receipts) | Recipient address and message content | US / EU |
Capability sub-processors
These are engaged only for the capabilities you use or connect. If you never run a video generation, no video provider processes your data.
| Sub-processor | Purpose | Data involved | Processing region |
|---|---|---|---|
| Sentry | Error monitoring | Error messages, stack traces, route and organisation identifiers. Secrets and personal data are stripped before send | EU / US |
| PostHog | Product analytics | Pseudonymous usage events; no third-party advertising cookies | EU |
| Vercel | Publishing customer-generated websites and custom domains | Site content you publish, DNS records | Global edge |
| Browserless | Headless browser sessions for computer-use tasks | Pages your agent visits during a scoped session; screenshots are held in memory only | EU / US |
| Firecrawl / Tavily / SerpApi | Web crawl, research and search-result data | Search and URL queries you request | US |
| fal.ai / Nano Banana / Higgsfield | Image and video generation | Generation prompts and reference images | US |
| ElevenLabs | Agora voice synthesis and realtime voice sessions | Voice session audio and transcripts | US / EU |
| Twilio | SMS delivery when enabled | Recipient number and message content | US |
| Nango / Composio | OAuth brokerage for connectors you choose to connect | OAuth tokens, encrypted at rest before storage | EU / US |
Connectors you add
When you connect an external account — an ad platform, an inbox, a store, an analytics property — that provider becomes a processor of the data you direct Knull to read or write there, under your own agreement with them. Connected accounts are listed in your workspace settings and can be disconnected at any time, which revokes Knull's stored token.
Cookie posture
Knull sets first-party cookies for authentication and session continuity only. We set no third-party advertising or cross-site tracking cookies, and we do not sell or share personal information for cross-context behavioural advertising. Product analytics are pseudonymous and can be disabled per organisation in privacy settings.
Your data rights
Export and deletion are self-service: workspace data export is available from the Ops screen, and account deletion is requested from privacy settings, which records the request and removes personal data on the documented schedule. Contact-level GDPR actions (export, erase) are available on each contact record. For anything the tooling does not cover, email privacy@knullos.lovable.app.
Changes to this register
We update this page when a sub-processor is added or removed. Customers on a signed DPA are notified of material additions before the new processor begins handling their data, and may object under the terms of the DPA.