Subprocessor Schedule
This schedule identifies providers Task Machine may use to process customer personal data and separately identifies important independent controllers. Provider names identify the service and legal entity where verified. A provider receives data only when the relevant feature, configuration, or instruction uses it.
Last updated: 21 September 2026
Core subprocessors
| Provider | Purpose | Data | Location and transfer notes |
|---|---|---|---|
| Cloudflare, Inc. | Authoritative DNS, application reverse proxy, web application firewall protection, TLS termination, and Turnstile abuse prevention. | DNS queries and resolver metadata; client IP addresses, URLs, request and response headers, cookies, authentication material, and customer content passing through the proxy; Turnstile challenge tokens and browser, TLS, and interaction signals. | Global network, including processing outside the EEA. Cloudflare terminates proxied TLS and uses a separate encrypted connection to our Scaleway origin. Its self-service agreement incorporates its DPA and international-transfer provisions. Primary application storage remains in Scaleway; Cloudflare caches and security records have separate lifecycles. |
| Scaleway | Application hosting, managed PostgreSQL, object storage, networking, static and CLI delivery with supporting DNS, transactional email, observability, and backups. | Account, workspace, workflow, transcript, upload, email, log, metric, and backup data. | Task Machine configures its primary application infrastructure and managed services in the EU. |
| Blaxel | Managed agent sandboxes, processes, and persistent worktree volumes. | Task and chat source files, repository history, working files, runtime requests, process state, and provider resource metadata. | Task Machine requests Frankfurt, Germany, as the infrastructure region for managed worktree volumes and attached sandboxes. This does not mean all related provider processing, network routing, logs, or backups occur only in that region. |
| PostHog Cloud EU | Server-side product analytics. | Profile and workspace identifiers, route and event metadata, enumerations, counts, durations, costs, internal-user flag, and user-originated IP address where geolocation is enabled. No prompts or customer content. | EU cloud in Frankfurt, Germany. PostHog Inc. is the service provider. |
| DataFast | Cookieless public website acquisition analytics, consent-based persistent cross-domain journey measurement, AI crawler reporting, and revenue attribution. | Public page paths, referrers, campaigns, IP address, user agent, pseudonymous visitor and session identifiers, crawler requests, and linked payment attribution. | DataFast-managed service. Cookieless browser analytics runs before acceptance and after rejection; persistent identifiers, cross-domain linking, and checkout attribution require acceptance. Contractual processing location and transfer details apply under DataFast's service terms. |
| OpenRouter | Gateway and routing for Task Machine managed model requests, including managed structured evaluations. | Prompts, context, messages, tool definitions and calls, generated responses, bounded evaluation state, typed questions and answers, model identifiers, token usage, request metadata, and workspace or run correlation needed for routing and settlement. | Global service. Workspace EU processing requirements route managed AI API payloads through OpenRouter's EU API under our DPA's EU-only addendum, with processing in the EU/EEA. The restriction does not cover account, billing, authentication, or other non-payload operational records. |
Downstream model providers through OpenRouter
Task Machine's managed model catalog can route a request through OpenRouter to the model developer selected by the customer or by an approved routing policy. Examples of model developers available through OpenRouter include Anthropic, OpenAI, Google, xAI, Moonshot AI, MiniMax, Alibaba through Qwen, DeepSeek, Mistral AI, and Zhipu AI through Z.ai. The downstream provider depends on the selected model and OpenRouter's applicable provider arrangements.
The selected provider receives the prompt, context, tool definitions and calls, generated content, and request metadata needed to answer the request. Available developers and models can change. Task Machine updates this schedule when the approved provider set changes. Customer-owned coding-tool and model-provider accounts used by Local Workers are outside the managed AI controls; Task Machine-managed workspace AI features remain subject to the workspace requirements.
Managed AI processing requirements
When EU processing is required, only qualifying regional endpoints are eligible. Requiring zero data retention as well narrows that set to endpoints meeting both requirements. Requests fail rather than fall back outside the applicable requirements. OpenRouter's EU-only commitments cover API payloads and remain subject to the addendum's applicable-law and written-instruction exceptions. They do not establish EU-only processing by Task Machine's other service providers.
Customer-selected services
A workspace may connect third-party MCP servers, communication systems, source hosts, coding tools, model providers, public-web services such as Exa, and other services. Those providers process data because Customer selected and instructed the connection. They are not Task Machine subprocessors when Customer contracts with and controls them directly. Their own terms, regions, retention, and security practices apply.
Independent controllers and recipients
Stripe and Link: the Link entity identified at checkout is merchant of record for Stripe Managed Payments. Link processes payment methods, transaction, billing-country, tax, fraud, refund, dispute, and support data as an independent controller under the checkout and Link terms. Link is not a subprocessor for workspace content.
Cloudflare: separately acts as controller when using Turnstile and Challenge Platform signals to improve bot detection under its Turnstile Privacy Addendum. This is distinct from its processor role in providing our security and delivery services.
Google: when a person chooses Google authentication or loads Google-hosted public website fonts, Google receives the requests and acts under its own terms and privacy notice.
Task Machine may also disclose limited information to professional advisers, public authorities, courts, or transaction counterparties where lawfully necessary.
Changes and objections
Task Machine updates this schedule and gives active DPA customers at least 15 days' advance notice through their recorded contact before a material new subprocessor starts processing Customer Personal Data, unless urgent security, legal, or service-continuity circumstances require a shorter period. A customer may object during that period on reasonable data-protection grounds as described in the Data Processing Addendum.
Questions, objections, or requests for current provider documentation can be sent to [email protected] . Read the Data Processing Addendum.