Subprocessors
These are the third parties that process personal data on our behalf, what each one receives, and where it processes it. We publish the full list rather than a summary, because a partial list is worse than none.
Last updated: 25 July 2026
Change notification. We update this page at least 30 days before a new processor begins handling member personal data, so that organisation customers have time to review and object. Every processor listed here is bound by a written data-protection agreement.
| Processor | Purpose | Data it receives | Processing location | Their certifications |
|---|---|---|---|---|
| Railway | Application hosting and PostgreSQL database | All application data at rest | United States | SOC 2 Type II |
| Cloudflare | CDN, DNS, object storage (R2), bot protection | Request metadata, IP addresses, uploaded media | Global edge network; R2 object storage is distributed and may hold copies outside the United States | SOC 2 Type II |
| Stripe | Payment processing | Name, email, payment metadata | United States | PCI DSS Level 1, SOC 2 |
| Anthropic | AI coaching content and written deliverables | Message text, conversation history, profile details, sprint commitments, extracted document text | United States | SOC 2 Type II |
| OpenAI | AI coaching responses and text-to-speech | Message text, conversation history, profile details, leadership diagnostic scores | United States | Not verified by us |
| ElevenLabs | AI voice generation during Voice Sessions | Coaching session text | United States, EU or Singapore | SOC 2 Type 2, ISO 27001, ISO 27701, ISO 42001, HIPAA |
| Nanonoble Pte Ltd (MiniMax) | AI voice generation during Voice Sessions | Coaching session text | United States data centre (vendor is a Singapore company) | Not verified by us |
| Resend | Transactional email delivery | Recipient email addresses, message content | United States | SOC 2 Type II |
| Twilio | SMS and WhatsApp messaging | Phone numbers, message content | United States | ISO 27001, SOC 2 |
| Microsoft | Calendar and contact sync (Graph API) | Calendar and contact data | United States | ISO 27001, SOC 2 |
| Sentry | Application error monitoring | Error context (personal data scrubbed before storage) | United States | SOC 2 Type II |
| Website analytics and tag management | Pages visited, time on site, referral source, IP address | United States | SOC 2, ISO 27001 |
Do AI providers train on your content?
The honest answer differs by provider, so we set it out per provider rather than making one blanket claim. Where a vendor does not give us a commitment, we say so.
OpenAI and Anthropic
Under the API terms on which we use them, content we send is not used to train their models. These are the two commitments we hold in writing.
ElevenLabs
On non-Enterprise plans, which is our current plan, ElevenLabs states that customer data may be used for research, development, training and product improvement. We therefore send only the session text needed to produce the audio.
MiniMax
MiniMax states it does not use input personal data to infer characteristics about an individual, nor for training to profile or target consumers. That is narrower than a general no-training commitment, so we treat it as such.
In every case we send only what is needed to produce the immediate response. Digital Twin training material, uploaded documents and assessment responses are never sent to a voice provider.
Frequently asked questions
See also our Privacy Policy and our Trust Centre.