To provide Korium, Kyroco engages a small number of third-party service providers (“subprocessors”) that may process personal information on our behalf. This page lists our current subprocessors, what they do, where they are located, and the safeguard we rely on for any transfer of personal data outside the EEA, UK, or Switzerland. It is referenced by, and forms part of, our Data Processing Addendum.
The subprocessors below fall into two groups: those that may handle Customer Content (the data you store in your Korium memory, which we process as your processor) and those that handle account, billing, or operational data that Kyroco controls. Because Korium runs on a US-based cloud region by default, most subprocessors are in the United States; each US transfer is covered by an appropriate safeguard, shown in the Transfer safeguard column.
What does not appear here on purpose: Korium performs both entity extraction (a GLiNER model) and vector embedding (a self-hosted Ollama model) using models that run inside our own AWS environment - your content is not sent to any third-party provider for entity extraction or embedding. The only external AI service is Anthropic’s Claude Haiku model, listed below, which is contractually prohibited from training on your content.
These providers form the infrastructure and AI layer that stores and processes the data you place in Korium.
| Subprocessor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Amazon Web Services, Inc.AWS | Cloud infrastructure and hosting: compute, managed database (memory storage), object storage, cache, key management, and secrets. | United States (us-east-1) | EU-US DPF + SCCs |
| Anthropic, PBCClaude API | Large-language-model inference (Claude Haiku) that writes memory summaries and code-search descriptions. Prompts are not used to train models. Anthropic deletes prompts and answers within 30 days by default. | United States | SCCs |
These providers support authentication, payments, delivery, and operating the Service.
| Subprocessor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Stripe, Inc.Payments | Payment processing, subscription billing, hosted checkout, and the customer billing portal. Kyroco does not store full card numbers. | United States | EU-US DPF + SCCs |
| Cloudflare, Inc.Network | DNS, content delivery, TLS termination, and network security (including the Zero Trust access tunnel). | United States / global edge | EU-US DPF + SCCs |
| Google LLCGoogle Workspace | Transactional and business email delivery (e.g. sign-in, account, and support messages). | United States | EU-US DPF + SCCs |
| Google LLCGoogle Analytics 4 | Website usage measurement on kyroco.ai, only after a visitor accepts cookies. Google’s advertising features are turned off. | United States | EU-US DPF + SCCs |
| HeyCatch, Inc.Website analytics | Website usage and marketing-channel measurement on kyroco.ai, only after a visitor accepts cookies: pages visited, referring channel, and clicks. Not used for advertising. | United States | SCCs |
When you choose to sign in with a third-party identity provider, that provider processes your login on your instruction. These are not subprocessors of your Customer Content; they authenticate access and return an identifier to us.
We keep this page current. Before we add a new subprocessor or replace an existing one that processes personal data, we will give affected customers advance notice of at least thirty (30) days through the mechanism described in our Data Processing Addendum, during which a customer may object on reasonable data-protection grounds. To receive change notifications, contact us at reports@kyroco.ai and ask to be added to the subprocessor-update list.
Each subprocessor is bound by a written agreement imposing data-protection obligations no less protective than those in our own Data Processing Addendum, including the EU Standard Contractual Clauses where required for international transfers. Kyroco remains responsible to its customers for the performance of its subprocessors.