Authorized Subprocessors
This page lists the third-party subprocessors that receive customer or end-user data when Overskill provides our services, what data each one receives, and where.
Last updated: October 15, 2026
October 2026 update: added the database, storage, AI, video, monitoring and support providers we already use, corrected where app data is stored, and removed providers that no longer receive customer data or are only used by features still in early access.
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Render, Inc. | Hosting for the Overskill web app, background processing and caches | All platform data while it is being processed; short-lived cached data | Oregon, USA (US West) |
| Amazon Web Services, Inc. | Platform database (Amazon Aurora); sending email from custom domains (Amazon SES) | Accounts, workspaces, chat history, app source code, support and billing records; email addresses and message content for custom-domain email | Database: AWS us-west-2 (Oregon, USA). Email: AWS us-east-1 (Virginia, USA) |
| Cloudflare, Inc. | Hosting and delivery for published apps, databases for new apps, file storage, DDoS protection, and routing of AI requests | App code and content, data your apps' end users submit, uploaded files and backups, AI requests | Global network. App databases: North America. File storage: Eastern North America |
| Turso (ChiselStrike, Inc.) |
Databases for apps created before September 2026
Older apps only; new apps use Cloudflare |
Data your apps' end users submit | AWS us-east-1 (Virginia, USA) |
| E2B | Build and preview environments for your apps | App source code and the app settings needed to build it | USA (Google Cloud) |
| Anthropic, PBC | AI models (Claude) for building apps and AI features | Prompts, chat history and app source code sent with AI requests | USA and other countries |
| OpenAI, LLC | AI models for building apps, image generation and AI features | Prompts, chat history and app source code sent with AI requests | USA and other countries |
| Google LLC | AI models (Gemini); search over the knowledge base of some older apps; website analytics | Prompts, app source code and app memories sent with AI requests; documents added to an older app's knowledge base; website usage data | Google data centers around the world |
| OpenRouter, Inc. |
Routes requests for some AI models to the companies that host them
For Kimi K3, requests go only to Modal, Baseten and Together AI in the USA; for GLM 5.2, only to Decart, Novita, DeepInfra and Fireworks. Hosts of Kimi K3 and GLM requests must keep no copy of them and must not train on them. Other models may be served by other hosts. |
Prompts, chat history and app source code sent with AI requests | USA and other countries (OpenRouter). Model hosts vary by model |
| fal (Features & Labels Inc.) | AI video generation for apps that use video features | Prompts, and the images, video and audio your app sends for video generation | USA and other countries |
| Morph | Applying code edits and searching your app's code | App source code, including copies of your app's files for code search, and edit instructions | USA and other countries |
| Perplexity AI, Inc. | Web research while building apps, and suggestions for app ideas typed on our homepage | Research questions based on your requests; app ideas typed on our homepage, including by visitors who are not signed in | USA and other countries |
| Firecrawl | Reading and searching web pages while building apps, and importing content from websites you point us to | Web addresses and search queries from your requests, and the content of those pages | USA |
| Urlbox | Screenshots of your apps for previews, thumbnails and share images | Web addresses of your apps, including unpublished previews with temporary access to capture them, and the pages it captures | USA |
| ElevenLabs | AI voice and audio for apps that use audio features | Text your app sends for speech or audio | USA |
| Composio | Connections to third-party accounts you choose to link, such as email or calendar | Connection details and the actions you ask a connected service to perform | Being confirmed; contact us for details |
| Entri | Setting up and buying custom domains | Your domain name and the DNS records it needs | USA |
| Whop, Inc. | Payments and billing (merchant of record), identity checks for creators who receive payouts, and support messages about purchases | Name, email address, payment and billing details, purchase history, identity verification for creators who receive payouts, support messages | USA and other countries |
| Resend | Account email, such as sign-in codes and notifications | Email address and email content | USA |
| Honeybadger Industries LLC | Error monitoring | Error reports, which can include account identifiers and email addresses | USA |
| AppSignal B.V. | Performance monitoring | Performance and error data, including filtered request details, which can include account identifiers | Netherlands (EU) |
| Slack Technologies, LLC | Internal alerts for our support team | Summaries of support requests | USA |
| GitHub, Inc. | Internal tracking of support issues and bug reports | Details from support requests you send us, including your name, email address and messages | USA and other countries |
Render, Inc.
Purpose: Hosting for the Overskill web app, background processing and caches
Location: Oregon, USA (US West)
Data: All platform data while it is being processed; short-lived cached data
Amazon Web Services, Inc.
Purpose: Platform database (Amazon Aurora); sending email from custom domains (Amazon SES)
Location: Database: AWS us-west-2 (Oregon, USA). Email: AWS us-east-1 (Virginia, USA)
Data: Accounts, workspaces, chat history, app source code, support and billing records; email addresses and message content for custom-domain email
Cloudflare, Inc.
Purpose: Hosting and delivery for published apps, databases for new apps, file storage, DDoS protection, and routing of AI requests
Location: Global network. App databases: North America. File storage: Eastern North America
Data: App code and content, data your apps' end users submit, uploaded files and backups, AI requests
Turso (ChiselStrike, Inc.)
Purpose: Databases for apps created before September 2026
Location: AWS us-east-1 (Virginia, USA)
Data: Data your apps' end users submit
Older apps only; new apps use Cloudflare
E2B
Purpose: Build and preview environments for your apps
Location: USA (Google Cloud)
Data: App source code and the app settings needed to build it
Anthropic, PBC
Purpose: AI models (Claude) for building apps and AI features
Location: USA and other countries
Data: Prompts, chat history and app source code sent with AI requests
OpenAI, LLC
Purpose: AI models for building apps, image generation and AI features
Location: USA and other countries
Data: Prompts, chat history and app source code sent with AI requests
Google LLC
Purpose: AI models (Gemini); search over the knowledge base of some older apps; website analytics
Location: Google data centers around the world
Data: Prompts, app source code and app memories sent with AI requests; documents added to an older app's knowledge base; website usage data
OpenRouter, Inc.
Purpose: Routes requests for some AI models to the companies that host them
Location: USA and other countries (OpenRouter). Model hosts vary by model
Data: Prompts, chat history and app source code sent with AI requests
For Kimi K3, requests go only to Modal, Baseten and Together AI in the USA; for GLM 5.2, only to Decart, Novita, DeepInfra and Fireworks. Hosts of Kimi K3 and GLM requests must keep no copy of them and must not train on them. Other models may be served by other hosts.
fal (Features & Labels Inc.)
Purpose: AI video generation for apps that use video features
Location: USA and other countries
Data: Prompts, and the images, video and audio your app sends for video generation
Morph
Purpose: Applying code edits and searching your app's code
Location: USA and other countries
Data: App source code, including copies of your app's files for code search, and edit instructions
Perplexity AI, Inc.
Purpose: Web research while building apps, and suggestions for app ideas typed on our homepage
Location: USA and other countries
Data: Research questions based on your requests; app ideas typed on our homepage, including by visitors who are not signed in
Firecrawl
Purpose: Reading and searching web pages while building apps, and importing content from websites you point us to
Location: USA
Data: Web addresses and search queries from your requests, and the content of those pages
Urlbox
Purpose: Screenshots of your apps for previews, thumbnails and share images
Location: USA
Data: Web addresses of your apps, including unpublished previews with temporary access to capture them, and the pages it captures
ElevenLabs
Purpose: AI voice and audio for apps that use audio features
Location: USA
Data: Text your app sends for speech or audio
Composio
Purpose: Connections to third-party accounts you choose to link, such as email or calendar
Location: Being confirmed; contact us for details
Data: Connection details and the actions you ask a connected service to perform
Entri
Purpose: Setting up and buying custom domains
Location: USA
Data: Your domain name and the DNS records it needs
Whop, Inc.
Purpose: Payments and billing (merchant of record), identity checks for creators who receive payouts, and support messages about purchases
Location: USA and other countries
Data: Name, email address, payment and billing details, purchase history, identity verification for creators who receive payouts, support messages
Resend
Purpose: Account email, such as sign-in codes and notifications
Location: USA
Data: Email address and email content
Honeybadger Industries LLC
Purpose: Error monitoring
Location: USA
Data: Error reports, which can include account identifiers and email addresses
AppSignal B.V.
Purpose: Performance monitoring
Location: Netherlands (EU)
Data: Performance and error data, including filtered request details, which can include account identifiers
Slack Technologies, LLC
Purpose: Internal alerts for our support team
Location: USA
Data: Summaries of support requests
GitHub, Inc.
Purpose: Internal tracking of support issues and bug reports
Location: USA and other countries
Data: Details from support requests you send us, including your name, email address and messages
Subprocessor Update Policy
In accordance with our Data Processing Agreement and GDPR requirements:
- We will provide 30 days' advance written notice before engaging any new subprocessor.
- Customers may object to new subprocessors within the notice period by identifying specific, material data protection concerns.
- If an objection cannot be resolved, affected customers may terminate without penalty.
- All subprocessors must meet our security standards (SOC 2 or ISO 27001 preferred).
Pre-Approved Categories
Our Data Processing Agreement authorizes subprocessors in the following categories, provided they meet our security standards:
Subscribe to Subprocessor Updates
Receive notifications when we add or change subprocessors, as required by your Data Processing Agreement.
Subscribe to Updates