Plain-language summary
- To provide NeuralOS we rely on 13 vendors (subprocessors) that process data only on our instructions.
- The table shows who each one is, what we use it for, what data it processes, and in which country.
- All of them are bound by contractual data protection and confidentiality obligations.
- If you have a data processing agreement (DPA) with us, we give you 30 days' notice before adding a new subprocessor, and you can object.
- Data is processed mainly in the USA, with safeguards for international transfers.
This summary helps you understand the essentials. The full text below is what governs.
1. What a subprocessor is
A subprocessor is a third-party vendor that processes personal data on behalf of Klinworks, LLC when we need it to provide NeuralOS: hosting the app, storing data, taking payments, sending email, or running AI models.
Subprocessors may only process data for the stated purpose and on our instructions. This list does not include services you connect yourself (for example, third-party integrations or providers you access with your own BYOK keys): in those cases, the relationship is directly between you and that provider.
This page complements our Privacy Policy and Security page.
2. List of subprocessors
| Subprocessor | Purpose | Data processed | Country |
|---|---|---|---|
| Supabase, Inc. | Database, authentication, and file storage | Account data and workspace content | USA |
| Vercel, Inc. | Hosting and delivery of the web app | Technical logs (IP address, user agent) | USA |
| Railway Corporation | Hosting of the API and background jobs | Data processed by the API | USA |
| Cloudflare, Inc. | Network, DNS, and abuse protection (Turnstile) | Technical logs | USA |
| Stripe, Inc. | Payments and billing | Billing data | USA |
| Resend (Plus Five Five, Inc.) | Transactional email delivery | Email address and notice content | USA |
| Functional Software, Inc. (Sentry) | Error monitoring | Technical error logs | USA |
| Anthropic, PBC | AI models (Claude) | Prompts and outputs | USA |
| OpenAI, L.L.C. | AI models | Prompts and outputs | USA |
| Google LLC | AI models (Gemini) | Prompts and outputs | USA |
| OpenRouter, Inc. | Routing to AI models for the ATLAS assistant on the website (only when the local engine cannot find an answer) | Text of the question sent to the assistant | USA |
| ElevenLabs, Inc. | AI-generated voice and audio | Text submitted for synthesis | USA |
| Replicate, Inc. · Fal (Features & Labels, Inc.) | AI image and video generation | Prompts and submitted files | USA |
AI providers receive only what is needed to generate each response and, under their business API terms, do not use that data to train their models. More details in the AI Use Policy.
3. How we select and oversee subprocessors
Before adding a vendor, we assess its security and privacy practices. With each subprocessor we:
- sign or accept a data processing agreement imposing protection obligations equivalent to ours;
- limit the data it receives to what is strictly necessary for its function;
- require confidentiality and appropriate technical and organizational security measures;
- periodically review whether it is still needed.
Klinworks, LLC remains responsible to you for its subprocessors' compliance.
4. How we notify you of changes
When we add or replace a subprocessor:
- We will update this page and its last-updated date.
- If you have a DPA with us, we will notify you by email at least 30 days in advance before the new subprocessor begins processing your data.
In urgent situations (for example, to maintain service continuity or security) we may change vendors with shorter notice; in that case we will notify you as soon as possible.
To receive these notices, email us at ceo@neuralos.io.
5. Right to object
If you have a DPA with us, you may object to a new subprocessor on reasonable data protection grounds by emailing ceo@neuralos.io within the notice period.
If you raise a reasonable objection, we will work in good faith to find a solution, such as preventing that vendor from processing your data or proposing an alternative. If that is not possible, you may terminate the affected service without penalty and receive a prorated refund of any prepaid fees for the unused period.
6. International transfers
Klinworks, LLC is based in the USA, and most of our subprocessors process data in the USA. When we transfer personal data from the European Economic Area, the United Kingdom, Switzerland, or other jurisdictions with similar requirements, we rely on recognized mechanisms, such as:
- the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) where the vendor is certified;
- the standard contractual clauses approved by the European Commission and their UK equivalents;
- supplementary security measures, such as encryption in transit and at rest.
More information in GDPR and the Privacy Policy.
7. Contact
For questions about subprocessors, to request change notices, or to exercise your right to object, email ceo@neuralos.io.
Klinworks, LLC · a Delaware limited liability company (USA) · file number 10704723.
Provider: Klinworks, LLC, a Delaware (USA) limited liability company, file number 10704723, which operates NeuralOS.