Subprocessors

This page lists the third-party companies (“subprocessors”) that Ontora Inc. engages to process personal data on behalf of customers in order to provide the Services described in our Privacy Policy. Each subprocessor operates under a written contract with Ontora that imposes confidentiality, security, and processing-only-on- instructions obligations consistent with GDPR Art. 28, POPIA operator requirements, and analogous obligations under U.S. state privacy laws.

We update this list before adding or replacing a subprocessor that processes customer personal data. If you have a Data Processing Agreement with Ontora and would like advance notice of changes, email privacy@ontora.com.

Cloud infrastructure and hosting

• Vercel Inc.(United States) — frontend hosting, edge functions, performance monitoring
• Porter Technologies, Inc.(United States) — backend application platform
• Amazon Web Services, Inc.(United States) — underlying compute, networking, and storage (EKS)

Databases and storage

• Supabase Inc.(United States, EU regions available) — managed PostgreSQL database and file storage
• Neo4j, Inc. (Neo4j Aura)(United States, EU regions available) — managed knowledge graph database

Authentication and identity

• Clerk Inc.(United States) — user authentication, session management, organization management

AI and machine-learning providers

• OpenAI, L.L.C.(United States) — embeddings, extraction, summarization, chat completions. API processing is not used for training
• Anthropic, PBC(United States) — Claude models for chat, extraction, and reasoning. API processing is not used for training
• Google LLC (Vertex AI / Gemini API)(United States, EU regions available) — Gemini models for chat and reasoning where selected
• Groq, Inc.(United States) — fast LLM inference for selected workloads
• xAI Corp.(United States) — Grok models for selected reasoning workloads
• Deepgram, Inc.(United States) — speech-to-text transcription for voice interviews and meetings
• ElevenLabs Inc.(United States) — text-to-speech synthesis for voice features
• Cartesia, Inc.(United States) — low-latency text-to-speech synthesis for voice features
• KugelAudio— low-latency text-to-speech synthesis for voice features

Third-party integration connectors

• Nango Inc.(United States, EU region available) — OAuth and sync infrastructure for connected third-party sources (Gmail, Google Drive, Google Calendar, Notion, Slack, and others)

Communications

• Resend, Inc.(United States) — transactional email delivery (account notices, invitations, interview confirmations)

Analytics and product measurement

• PostHog Inc.(United States, EU region available) — product analytics and usage measurement
• Google LLC (Google Analytics)(United States) — web analytics for our marketing site

Consent management

• c15t(open-source, client-side) — cookie consent banner and preference center. Operated in client-side mode: preferences are stored in the visitor's browser and are not transmitted to c15t's servers. Listed here for full transparency even though it does not act as a traditional subprocessor under this configuration.

Scheduling and customer operations

• Cal.com, Inc.(United States) — meeting scheduling
• Attio Limited(United Kingdom) — CRM for Ontora's sales and customer success operations

International transfer safeguards

Where personal data is transferred from the EEA, UK, or Switzerland to a subprocessor outside those regions, the transfer is governed by the European Commission's Standard Contractual Clauses (Decision 2021/914), the UK International Data Transfer Addendum, the Swiss FDPIC addendum, and (where applicable) the subprocessor's certification under the EU-U.S. Data Privacy Framework, the UK Extension, and the Swiss-U.S. Data Privacy Framework. For transfers from South Africa, we rely on POPIA section 72 and binding contractual commitments.

Questions

Email privacy@ontora.com with subprocessor questions, DPA requests, or to subscribe to advance-notice updates.