Subprocessors
Every company outside Rezee that can touch your data, what it does, and what it can actually see.
Last updated 10 September 2026
The list
These are the companies we rely on to run Rezee. The Data Processing Addendum binds each of them to terms no weaker than the ones we give you, and each is given only what its row below describes. A company is on this list because production actually reaches it, not because the code could be configured to.
Before a new one starts processing your data we publish it here and email workspace owners at least 30 days ahead, so there is time to object. To be told about changes, write to support@rezee.app and we will add you.
| Company | What it does for us | What it can reach | Where |
|---|---|---|---|
| Google Cloud Platform | The instance the API, the database, the git server and the CI scheduler run on. This is where a workspace lives. | Everything you put in Rezee: account details, issues, documents, messages, repositories, pull requests, pipeline configuration and the audit log. | United States (us-east1) |
| Vercel | Serves rezee.app and the web app itself. Both are static bundles; every request for your data goes from your browser to api.rezee.app, not through here. | Request metadata only - IP address, user agent, and which page was asked for. | Global edge network |
| Amazon Web Services | The host CI runs on, and the bucket pipeline artifacts are stored in. | A checkout of the repository a build is for, its logs, its artifacts, and the pipeline secrets that build needs - held in memory for the length of the run. | United States (us-east-1) |
| Stripe | Subscriptions, payment and invoices. | Billing contact, workspace name, plan and payment history. Card details go from your browser to Stripe and are never sent to or stored by us. | United States, with global processing |
| Resend | Sends transactional email: address verification, invitations, password resets and notification digests. | The recipient's name and email address, and the contents of that message - which for a digest includes the titles of what you were notified about. | United States |
| Apple Push Notification service | Delivers notifications to the Rezee iOS app. | A device push token and the text of the notification, which is usually a sender and a line of a message. | United States |
| OpenRouter | Routes agent work to a language model when an agent runs on Rezee's own key, and reads customer feedback for what it asks for. OpenRouter is the only model vendor we hold an account with; it passes each request to the model the task calls for, today from Anthropic, OpenAI, Google or xAI. | Whatever the task puts in the prompt - issue text, document contents and the source files the agent reads to do the job. For customer feedback, its subject, text and the sender's category, never the sender's name or address; a workspace can turn this reading off. Whichever of those four serves the request sees the same prompt. A workspace running on its own model key sends agent work to the provider it chose instead, and OpenRouter sees nothing of it. | United States |
| Cloudflare | Hosts the CLI and desktop app downloads that rezee.app redirects to. | None of yours. Public release binaries, plus the request metadata any download has. | Global edge network |
Your own model key
A workspace can run agents on its own provider key. When it does, prompts go to the provider that workspace chose and ours sees nothing - which makes the model provider your subprocessor rather than one of ours, and is the cleanest answer if a model vendor is the part of this list your reviewer cannot accept.
Not on this list
There is no analytics vendor, no advertising network, no session recorder, no support-chat widget and no font CDN. The website and the app load nothing from a third party, which is also why there is no cookie banner: the only cookies are the ones that keep you signed in.