This page lists the third-party companies (“subprocessors”) that Ontora Inc. engages to process personal data on behalf of customers in order to provide the Services described in our Privacy Policy. Each subprocessor operates under a written contract with Ontora that imposes confidentiality, security, and processing-only-on- instructions obligations consistent with GDPR Art. 28, POPIA operator requirements, and analogous obligations under U.S. state privacy laws.
We update this list before adding or replacing a subprocessor that processes customer personal data. If you have a Data Processing Agreement with Ontora and would like advance notice of changes, email privacy@ontora.com.
Cloud infrastructure and hosting
- Vercel Inc. (United States) — frontend hosting, edge functions, performance monitoring
- Porter Technologies, Inc. (United States) — backend application platform
- Amazon Web Services, Inc. (United States) — underlying compute, networking, and storage (EKS)
Databases and storage
- Supabase Inc. (United States, EU regions available) — managed PostgreSQL database and file storage
- Neo4j, Inc. (Neo4j Aura) (United States, EU regions available) — managed knowledge graph database
Authentication and identity
- Clerk Inc. (United States) — user authentication, session management, organization management
AI and machine-learning providers
- OpenAI, L.L.C. (United States) — embeddings, extraction, summarization, chat completions. API processing is not used for training
- Anthropic, PBC (United States) — Claude models for chat, extraction, and reasoning. API processing is not used for training
- Google LLC (Vertex AI / Gemini API) (United States, EU regions available) — Gemini models for chat and reasoning where selected
- Groq, Inc. (United States) — fast LLM inference for selected workloads
- xAI Corp. (United States) — Grok models for selected reasoning workloads
- Deepgram, Inc. (United States) — speech-to-text transcription for voice interviews and meetings
- ElevenLabs Inc. (United States) — text-to-speech synthesis for voice features
- Cartesia, Inc. (United States) — low-latency text-to-speech synthesis for voice features
- KugelAudio — low-latency text-to-speech synthesis for voice features
Third-party integration connectors
- Nango Inc. (United States, EU region available) — OAuth and sync infrastructure for connected third-party sources (Gmail, Google Drive, Google Calendar, Notion, Slack, and others)
Communications
- Resend, Inc. (United States) — transactional email delivery (account notices, invitations, interview confirmations)
Analytics and product measurement
- PostHog Inc. (United States, EU region available) — product analytics and usage measurement
- Google LLC (Google Analytics) (United States) — web analytics for our marketing site
Consent management
- c15t (open-source, client-side) — cookie consent banner and preference center. Operated in client-side mode: preferences are stored in the visitor's browser and are not transmitted to c15t's servers. Listed here for full transparency even though it does not act as a traditional subprocessor under this configuration.
Scheduling and customer operations
- Cal.com, Inc. (United States) — meeting scheduling
- Attio Limited (United Kingdom) — CRM for Ontora's sales and customer success operations
International transfer safeguards
Where personal data is transferred from the EEA, UK, or Switzerland to a subprocessor outside those regions, the transfer is governed by the European Commission's Standard Contractual Clauses (Decision 2021/914), the UK International Data Transfer Addendum, the Swiss FDPIC addendum, and (where applicable) the subprocessor's certification under the EU-U.S. Data Privacy Framework, the UK Extension, and the Swiss-U.S. Data Privacy Framework. For transfers from South Africa, we rely on POPIA section 72 and binding contractual commitments.
Questions
Email privacy@ontora.com with subprocessor questions, DPA requests, or to subscribe to advance-notice updates.