Last updated:
Overview
Rills uses a small set of third-party service providers ("subprocessors") to provide the service. This page is the authoritative list referenced by ourPrivacy Policy and ourData Processing Agreement. Each subprocessor receives only the data necessary for its specific function, and each is bound by data protection obligations materially equivalent to those we make to you.
AI requests deserve a special note: they are routed through an AI gateway to the model you select, and are served only by providers with verified agreements not to use your data to train their models. Whichever provider serves a request, the same no-training and zero-retention policy applies.
Current Subprocessors
| Provider | Purpose | Location |
|---|---|---|
| Vercel | Infrastructure: hosting, compute, functions, and AI gateway routing | US |
| Neon | Database: PostgreSQL data storage | US |
| Postmark | Email: transactional emails | US |
| PostHog | Analytics: usage data, consent-gated session replay, product analytics, and AI request logs (prompts & responses) for debugging and quality | US/EU |
| Sentry | Observability: error & crash tracking (web and mobile apps) | US |
| Grafana Cloud | Observability: logs, metrics, and traces | US |
| Polar | Billing: payment processing, merchant of record | EU |
| Upstash | Infrastructure: rate limiting, workflow execution | US |
| AI model providers | AI: workflow actions, optimization, and generation, routed through an AI gateway to the model you select | US / varies by model |
| Statsig | Feature flags: experiment assignments and feature rollouts | US |
| HubSpot | CRM: product-lifecycle email audience, including account email, name, signup date, and product usage flags | US |
Changes & Notifications
Before a new subprocessor begins processing customer data, we update this page and email workspace owners at least 30 days in advance. If you object to a new subprocessor on reasonable data protection grounds, emailprivacy@rills.ai within the notice period; the objection process is described in the DPA.
Removals and changes that do not involve new access to customer data are reflected on this page as they happen.