Subprocessors

Markbase is a software product operated by AltaCoda LLC (“AltaCoda,” “we,” “us,” or “our”). The following third-party subprocessors may process personal data on behalf of AltaCoda in connection with the provision of the Markbase Service:

The purposes below describe the shared hosted service. For a dedicated or self-hosted enterprise deployment, only a listed subprocessor that is used for that delivery model and processes personal data on our behalf applies. The applicable Enterprise Order may identify a deployment-specific subset or additional authorized subprocessors.

Subprocessor	Purpose	Location	Data Processed
Hetzner Online GmbH	Application infrastructure and hosting (Kubernetes cluster running the API, OAuth Authorization Server, Postgres database, and search index)	Germany	All categories of Personal Data
Amazon Web Services, Inc.	Object storage for documents and for attachments to email sent to Emails addresses (S3, us-east-1); Route 53 DNS; S3 and CloudFront delivery for the marketing site (markbase.cloud); Amplify Hosting and CloudFront delivery for the dashboard SPA (app.markbase.cloud)	United States and global edge	Workspace Content (including any Personal Data submitted as Content); email attachments; IP addresses; request metadata; static assets
Cloudflare, Inc.	Hosted Dispatch intake and durable buffering (Workers, Queues, Durable Objects, R2); skill-bundle and signed-release delivery	United States and global network	Webhook payloads and selected headers, messages received from connected tools for Mentions, job prompts and delivery state, live activity events where a profile turns them on, runner identifiers and acknowledgments, skill bundles, IP addresses and request metadata
Google LLC	Sign-in with Google (authentication); Google Tag Manager and Google Analytics 4 on the marketing and documentation sites	United States	Account identifiers, email addresses, authentication events; anonymized marketing-site and documentation-site usage data
GitHub, Inc. (a Microsoft company)	Sign-in with GitHub (authentication)	United States	Account identifiers, usernames, email addresses, authentication events
SendOps (a product of AltaCoda LLC, running on Amazon Web Services and Hetzner Online GmbH)	Temporary inboxes: receiving an email the user forwards to a short-lived address so their agent can read it. Emails addresses: receiving email sent to an organization’s permanent address and passing it to Markbase to start a Dispatch job	Ireland (receipt) and Germany	Received messages and their attachments and headers, sender and recipient addresses, the allowed sender’s email address, and a pseudonymous user identifier
Mixpanel, Inc.	Product analytics for the dashboard and Service usage	United States	Pseudonymous user identifiers, event metadata, device and browser information
Stripe, Inc.	Payment processing for paid Subscription Plans: checkout, subscriptions, invoicing, and sales-tax calculation	United States and global	Billing contact details (organization name, billing email and address), payment card details (collected and stored by Stripe; we receive only the card brand, last four digits, and expiry), subscription and invoice records, tax identifiers where provided
TypeSafe AI, Inc.	Automatic Dispatch job selection: choosing a job’s runner lane or run settings when a profile field is set to auto and Markbase’s own rules do not decide it	United States	The first 8 KB of the job’s rendered prompt, normalized fields of the triggering alert or webhook payload, and lane names and descriptions; never secrets, tokens or attachments

Cloudflare’s processing is subject to its Data Processing Addendum. On-prem Dispatch and skill delivery use the Customer’s install rather than AltaCoda’s hosted Cloudflare delivery path.

For a temporary inbox, SendOps holds a forwarded message only until the inbox expires, and deletes the raw copy within a day; Markbase itself never stores or logs the content of those messages. An inbox accepts mail only from the user’s own login email unless the user chooses otherwise.

Emails addresses work differently: Markbase stores the message and its attachments so the job’s agent can read them, and deletes the message body, headers and attachments seven days after the job ends.

Mentions exchange messages with Linear, GitHub and Slack when the Customer connects those tools and people use them to mention Markbase. These are third-party services the Customer chooses and uses under its own agreements with them, not subprocessors engaged by AltaCoda.

TypeSafe AI is called only for a Dispatch job whose profile leaves a field set to auto; hooks with fully specified profiles send it nothing. Its handling of this data is described in its Privacy Policy, which states that the service is hosted in the United States and that it does not train models on customer input. Self-hosted installs call TypeSafe AI only with the Customer’s own API key, under the Customer’s own agreement with TypeSafe AI, so it is not AltaCoda’s subprocessor for those deployments.

Temporary webhooks use no additional subprocessor: requests to a temporary webhook URL are received and held by the Markbase application and database hosted by Hetzner Online GmbH, not by Cloudflare. Their content is deleted one hour after the URL expires.

We ensure that each subprocessor is contractually bound to process personal data in accordance with applicable data protection laws and our Privacy Policy.

This list may be updated from time to time as we add or remove subprocessors. Material changes will be communicated in accordance with our Data Processing Addendum (DPA).

To subscribe to subprocessor change notifications, or to raise a question about any subprocessor listed above, contact us at hello@altacoda.io.

---

Last updated: November 2, 2026