Sub-processors
Last updated: 27 September 2026
About this list
Arasta uses certain third-party service providers to assist in delivering the Service.
A provider is listed below where it may process Customer Personal Data on Arasta’s behalf in connection with the provision of the Service.
The exact providers involved may depend on Customer configuration, enabled integrations, selected AI models and deployment region.
A provider marked conditional receives Customer Personal Data only when the relevant feature or model is enabled.
| Service provider | Purpose | Processing location | Transfer safeguards / notes |
|---|---|---|---|
| Anthropic, PBC | AI model inference and generation through the Anthropic commercial API | United States and other locations permitted under Anthropic’s DPA | Anthropic commercial DPA and applicable international-transfer safeguards |
| Voyage AI Innovations, Inc. [CONFIRM CONTRACTING ENTITY — Voyage AI is part of MongoDB, Inc.] | Text embeddings and semantic retrieval | United States | Voyage AI DPA and applicable international-transfer safeguards |
| Twilio Inc. (SendGrid) | Transactional email: verification codes, replies to offline messages and notifications to Customer’s team | United States | Twilio DPA and applicable international-transfer safeguards |
| Cloudflare, Inc. | Network delivery, reverse proxy and security services; Turnstile abuse and bot protection where enabled | Global network | Cloudflare DPA and applicable SCC / UK international-transfer mechanisms |
| Contabo GmbH | Hosting of Arasta application services, databases, backups and supporting infrastructure | European Union (France) | Contabo DPA; processing within the EU |
| Amazon Web Services (applicable AWS contracting entity) (conditional) | Fallback AI model inference through Amazon Bedrock when the primary AI provider is unavailable and failover is enabled | Region selected in Arasta’s configuration | AWS DPA and applicable international-transfer safeguards |
| Functional Software, Inc. dba Sentry (conditional) | Application error reporting, performance monitoring and diagnostics | United States and/or Germany depending on configuration | Sentry DPA and applicable international-transfer safeguards |
| Cloudflare, Inc. (R2) or another S3-compatible storage provider (conditional) | Storage of files such as invoice copies shared in a conversation and uploaded knowledge documents, when file storage is enabled | [REGION — WHEN ENABLED] | Provider DPA and applicable transfer mechanism |
AI processing
Arasta may send relevant portions of a conversation and associated context to an AI model provider in order to generate a response.
Arasta seeks to minimise the information supplied to AI providers to what is reasonably necessary for the requested operation. Verification codes entered by customers are never sent to an AI provider.
The AI provider used for a particular request may depend on Arasta configuration, model-routing rules and Customer-enabled features.
Where a provider is marked conditional above, it does not receive Customer Personal Data unless its relevant functionality is enabled.
Embeddings and knowledge retrieval
Arasta may use Voyage AI to convert authorised Customer content into numerical vector representations (“embeddings”) used for semantic search and retrieval.
Embeddings may be generated from Customer-provided knowledge-base, CMS, policy, product-support or other authorised content.
Arasta uses retrieved information to provide context to an AI model when answering a relevant customer request.
Providers used for Arasta’s own business operations
The following providers are used by Arasta for its own account administration, billing or business operations. Where they do not process Customer Personal Data on Customer’s behalf, they are not treated as sub-processors under the Arasta DPA:
- Stripe — Arasta subscription billing and payment processing.
- Shopify — Arasta subscription billing for merchants who subscribe through the Shopify app.
- WorkOS — sign-in and authentication for Customer’s team members in the Arasta dashboard.
Where the role of any of these providers changes so that it processes Customer Personal Data on Customer’s behalf, Arasta will add it to the sub-processor table above.
Services that Customer connects to Arasta, such as its ecommerce platform (Adobe Commerce, Magento Open Source or Shopify) or a Slack channel for notifications, are Customer’s own providers and are not Arasta sub-processors.
Notice of changes
Arasta may add or replace sub-processors as the Service evolves.
Where required by applicable Data Protection Laws, Arasta will provide reasonable advance notice before a new sub-processor materially processes Customer Personal Data.
Customers with a legitimate data-protection concern regarding a new sub-processor may contact:
Arasta and the Customer will work in good faith to address reasonable objections in accordance with the Data Processing Agreement.