Sub-Processors
Last updated: April 6, 2026
Agent Runway uses the following third-party service providers (sub-processors) to operate our platform. Each provider processes personal information on our behalf and is bound by a Data Processing Agreement (DPA) requiring them to: use personal information only for specified purposes, implement appropriate security safeguards, notify us of any data breach, return or delete data upon termination, and permit audit of their data handling practices. These contractual protections ensure a comparable level of protection to Canadian privacy law, as required under PIPEDA.
| Provider | Purpose | Data Processed | Location | Security |
|---|---|---|---|---|
| Supabase | Database & Authentication | All application data including user accounts, CRM contacts, transactions, financial records | Canada (AWS ca-central-1, Montreal) | SOC 2 Type II, AES-256 encryption at rest |
| Stripe | Payment Processing | Payment method tokens, subscription records, billing information | United States | PCI DSS Level 1 |
| Anthropic | AI Processing (Claude — primary LLM) | User queries, business context data, client information for AI features | United States | DPA in place, zero data retention for API traffic, not used for model training |
| Groq | AI Processing (fallback LLM and voice transcription) | User queries, business context data, client information; audio for voice features | United States | DPA in place, no data retention |
| Plaid | Bank Account Sync (coming soon) | Bank credentials (held by Plaid), transaction data | United States | SOC 2 Type II, ISO 27001 |
| Vercel | Hosting & Analytics | Application code, page view analytics, performance metrics | United States / Global CDN | SOC 2 Type 2 |
| Sentry | Error Tracking | Error logs, performance data, anonymized session recordings | United States | SOC 2 |
| Resend | Email Delivery | Email addresses, email content | United States | N/A |
| Integrations (Gmail, Calendar, Drive) | Email, calendar events, documents (accessed via OAuth) | United States / Global | Google API User Data Policy |
Important: Some of our sub-processors are located in the United States. Your data may be accessible to US law enforcement under applicable US laws, including the CLOUD Act. For more information, see our Privacy Policy.
Sub-processor change notification: We will update this page when we add, remove, or change a sub-processor. Material changes (new providers processing sensitive personal information) will be communicated via email to active account holders at least 30 days before the new sub-processor begins processing data, giving you the opportunity to review the change and exercise your rights under our Privacy Policy.
We review our sub-processors regularly. If you have questions about how your data is processed or would like to review our DPAs, contact our Privacy Officer at privacy@agentrunway.ca.