Trust
Subprocessors
A subprocessor is a third party that may process customer data on our behalf. This page lists them by role, so you can see who is involved before you connect anything.
1. Infrastructure
| Role | Provider | Data processed | Region |
|---|---|---|---|
| Compute and database hosting | Named on request from privacy@korps.ai | All control-plane records: accounts, workspaces, agents, runtimes, sessions, usage, avatars | Named on request from privacy@korps.ai |
| TLS certificates | Let's Encrypt (Internet Security Research Group) | Domain names only. No customer data. | United States |
| Domain registration and DNS | Named on request from privacy@korps.ai | Domain records only. No customer data. | Named on request from privacy@korps.ai |
| Transactional email | None in use | Korps sends no automated email today. | Not applicable |
| Analytics, advertising, session recording | None in use | No third-party tracking is loaded on korps.ai. The marketing pages measure themselves, first party only, on our own servers, with no third party involved. See Cookies. | Not applicable |
2. Model providers
Model providers are engaged per workspace, by your configuration. Korps does not send your content to a provider you have not connected to an agent.
Status today: Korps records which provider each agent is assigned to, but it does not hold your provider credential and does not make the model call itself. The key stays on the server you attached, and that server is what contacts the provider. So a provider becomes your processor through your own credential and your own machine, and Korps is not in the path of your prompts.
| Provider | Data processed | Engaged when |
|---|---|---|
| Anthropic | Prompt and response content for agents you assign to it, plus token counts | You connect it to an agent |
| OpenAI | Prompt and response content for agents you assign to it, plus token counts | You connect it to an agent |
| xAI | Prompt and response content for agents you assign to it, plus token counts | You connect it to an agent |
| Google (Gemini) | Prompt and response content for agents you assign to it, plus token counts | You connect it to an agent |
| DeepSeek | Prompt and response content for agents you assign to it, plus token counts | You connect it to an agent |
If you bring your own provider credential, that provider is your contractual counterparty, and their terms govern whether your prompts are retained or used for training. Check them. Korps does not use your content to train models.
3. Infrastructure you attach
Servers, VPS hosts and runtimes you connect to Korps are yours, not ours. Your hosting provider for those machines is your subprocessor, not a Korps subprocessor, and their terms and location are your responsibility.
4. Diligence
Before engaging a subprocessor we intend to check that it offers security appropriate to the data, that a written processing agreement is in place, and that a lawful transfer mechanism exists where data leaves the UK or EEA. Ask privacy@korps.ai which agreements are executed with a particular supplier.
5. Notification of changes
We will publish additions or replacements here before they start processing customer data, and we intend to give at least 30 days' notice for material changes so customers can object. Customers who have signed the Data Processing Addendum may object as set out there. To be told about a change in advance, ask privacy@korps.ai to add you to the notice list.