Subprocessor Schedule
This schedule identifies providers Task Machine may use to process customer personal data and separately identifies important independent controllers. A provider receives data only when the relevant feature, configuration, or instruction uses it.
Last updated: 7 August 2026
Core subprocessors
| Provider | Purpose | Data | Location and transfer notes |
|---|---|---|---|
| Scaleway | Application hosting, managed PostgreSQL, object storage, networking, DNS, transactional email, observability, and backups. | Account, workspace, workflow, transcript, upload, email, log, metric, and backup data. | Task Machine configures its primary application infrastructure and managed services in the EU. |
| Blaxel | Managed agent sandboxes, processes, and persistent worktree volumes. | Task and chat source files, repository history, working files, runtime requests, process state, and provider resource metadata. | Provider-managed infrastructure. Processing location depends on the selected managed region and provider routing. |
| PostHog Cloud EU | Server-side product analytics. | Profile and workspace identifiers, route and event metadata, enumerations, counts, durations, costs, internal-user flag, and user-originated IP address where geolocation is enabled. No prompts or customer content. | EU cloud in Frankfurt, Germany. PostHog Inc. is the service provider. |
| DataFast | Consent-based public website acquisition analytics, cross-domain journey measurement, AI crawler reporting, and revenue attribution. | Public page paths, referrers, campaigns, IP address, user agent, pseudonymous visitor and session identifiers, crawler requests, and linked payment attribution. | DataFast-managed service. Browser analytics starts only after consent. Contractual processing location and transfer details apply under DataFast's service terms. |
| OpenRouter | Gateway and routing for Task Machine managed model requests. | Prompts, context, messages, tool definitions and calls, generated responses, model identifiers, token usage, request metadata, and workspace or run correlation needed for routing and settlement. | External service with onward processing by the selected model developer. Location and transfer details depend on OpenRouter and that model developer. |
| Exa | Default agent public-web search and page fetching. | Search queries, requested public URLs, returned public content, request metadata, and the local or managed worker's egress IP address. | Exa-hosted service. Processing region and transfer details follow Exa's service configuration and terms. |
Downstream model providers through OpenRouter
Task Machine's managed model catalog can route a request through OpenRouter to the model developer selected by the customer or by an approved routing policy. The current approved developers are Anthropic, OpenAI, Google, xAI, Moonshot AI, MiniMax, Alibaba through Qwen, DeepSeek, Mistral AI, and Zhipu AI through Z.ai.
The selected provider receives the prompt, context, tool definitions and calls, generated content, and request metadata needed to answer the request. Available developers and models can change. Task Machine updates this schedule when the approved provider set changes. Customer can avoid managed model processing by using eligible local execution with its own coding-tool and model-provider configuration.
Customer-selected services
A workspace may connect third-party MCP servers, communication systems, source hosts, coding tools, model providers, and other services. Those providers process data because Customer selected and instructed the connection. They are not Task Machine subprocessors when Customer contracts with and controls them directly. Their own terms, regions, retention, and security practices apply.
Independent controllers and recipients
Stripe and Link: the Link entity identified at checkout is merchant of record for Stripe Managed Payments. Link processes payment methods, transaction, billing-country, tax, fraud, refund, dispute, and support data as an independent controller under the checkout and Link terms. Link is not a subprocessor for workspace content.
Google: when a person chooses Google authentication or loads Google-hosted public website fonts, Google receives the requests and acts under its own terms and privacy notice.
Task Machine may also disclose limited information to professional advisers, public authorities, courts, or transaction counterparties where lawfully necessary.
Changes and objections
Task Machine updates this schedule before a material new subprocessor starts processing Customer Personal Data. Active DPA customers receive reasonable advance notice through their recorded contact where required. A customer may object on reasonable data-protection grounds as described in the Data Processing Addendum.
Questions, objections, or requests for current provider documentation can be sent to support@taskmachine.io . Read the Data Processing Addendum.