Sub-processors
Last updated: May 9, 2026
Esan engages the following third-party processors to deliver the Service. Each processor is bound by a written agreement compliant with Article 28 of the EU General Data Protection Regulation (GDPR), including obligations of confidentiality, security and data protection by design.
We notify connected users by email at least 14 days before adding or replacing a sub-processor that processes personal data, so you can object before the change takes effect. Past versions of this list are archived and available on request to hey@esan.ai.
Current sub-processors
| Sub-processor | Purpose | Location | International transfer safeguards |
|---|---|---|---|
| Anthropic, PBC | Large language model inference (Claude) for the agent's reasoning, tool selection and content generation. | United States | EU Standard Contractual Clauses (SCCs), Module 2. |
| OpenAI, LLC | Embeddings for semantic memory retrieval and auxiliary LLM calls (title generation, classification). | United States | EU Standard Contractual Clauses (SCCs), Module 2. |
| Google LLC | Gemini embedding API for memory feature; Workspace APIs (Gmail, Drive, Calendar) when you connect those services. | United States and EU regional infrastructure | EU Standard Contractual Clauses (SCCs); EU regional storage where available. |
| Supabase Inc. | Managed PostgreSQL database, authentication, file storage, encryption-at-rest helpers. | European Union (eu-west-1, Ireland) by default for Esan data. | In-region storage; no transfer outside EEA for primary database. |
| Vercel Inc. | Frontend hosting, edge serverless functions, CDN. | Global edge network with regional preferences. | EU Standard Contractual Clauses (SCCs); regional routing where available. |
| E2B Inc. | Sandbox virtual machines for isolated code execution and file processing. | United States | EU Standard Contractual Clauses (SCCs), Module 2. Sandboxes are ephemeral; no user data is persisted by E2B beyond session lifetime. |
| Stripe Payments Europe Ltd | Subscription billing and payment processing (only when you subscribe to a paid plan). | Republic of Ireland (EU) | In-region; Stripe handles its own SCCs for any onward transfer. |
Infrastructure providers we do NOT classify as sub-processors
The following providers process only metadata or technical data (no message content, no Google user data, no user-identifying Personal Data beyond standard request logs) and are therefore not classified as sub-processors of personal data, although we list them here for transparency:
- Cloudflare, Inc. — DNS and DDoS protection for the public domain.
- Sentry / observability provider — error tracking; configured to exclude message bodies and user content from stack traces.
Notification of changes
To receive proactive notification of changes to this list, ensure that the email address on your Esan account is current. You may also subscribe to changes by writing to hey@esan.ai with the subject line "Subscribe to sub-processor updates".
Right to object
If you have a reasonable, well-documented objection to a new sub-processor (e.g. a conflict of interest, a regulatory constraint affecting your industry, or a credible security concern), notify us within the 14-day notice window. We will work in good faith to address the concern, and where it cannot be resolved you may terminate your subscription with a pro-rata refund of any prepaid fees.