Sub-processors
Last updated: July 18, 2026
Esan engages the following third-party processors to deliver the Service. Each processor is bound by a written agreement compliant with Article 28 of the EU General Data Protection Regulation (GDPR), including obligations of confidentiality, security and data protection by design.
We notify connected users by email at least 14 days before adding or replacing a sub-processor that processes personal data, so you can object before the change takes effect. Past versions of this list are archived and available on request to support@esan.ai.
Current sub-processors
| Sub-processor | Purpose | Location | International transfer safeguards |
|---|---|---|---|
| Anthropic, PBC | Foundational models | United States | EU Standard Contractual Clauses (SCCs), Module 2. |
| OpenAI, LLC | Foundational models | United States | EU Standard Contractual Clauses (SCCs), Module 2. |
| Google LLC | Foundational models; Workspace APIs when you connect them | United States and EU regional infrastructure | EU Standard Contractual Clauses (SCCs); EU regional storage where available. |
| Supabase Inc. | Database, authentication and storage | European Union (eu-west-1, Ireland) by default for Esan data. | In-region storage; no transfer outside EEA for primary database. |
| Vercel Inc. | Cloud infrastructure | Global edge network with regional preferences. | EU Standard Contractual Clauses (SCCs); regional routing where available. |
| E2B Inc. | Code-execution sandboxes | United States | EU Standard Contractual Clauses (SCCs), Module 2. Sandboxes are ephemeral; no user data is persisted beyond session lifetime. |
| Stripe Payments Europe Ltd | Billing and Wallet payments | Republic of Ireland (EU) | In-region; Stripe handles its own SCCs for any onward transfer. |
For the payment-card, identity-verification and bank-account data you provide directly to Stripe, Stripe acts as an independent data controller under its own privacy policy (see our Privacy Policy, Section 5).
Infrastructure providers we do NOT classify as sub-processors
The following providers either process only metadata or technical data (no message content, no Google user data, no user-identifying Personal Data beyond standard request logs), or act as independent data controllers in their own right. They are therefore not classified as sub-processors of Esan, although we list them here for transparency:
- Cloudflare, Inc. — DNS and DDoS protection for the public domain.
- Sentry / observability provider — error tracking; configured to exclude message bodies and user content from stack traces.
Notification of changes
To receive proactive notification of changes to this list, ensure that the email address on your Esan account is current. You may also subscribe to changes by writing to support@esan.ai with the subject line "Subscribe to sub-processor updates".
Right to object
If you have a reasonable, well-documented objection to a new sub-processor (e.g. a conflict of interest, a regulatory constraint affecting your industry, or a credible security concern), notify us within the 14-day notice window. We will work in good faith to address the concern, and where it cannot be resolved you may terminate your subscription with a pro-rata refund of any prepaid fees.