Last updated
Sub-processors
Every third party that processes personal data on our behalf, what it is there for, what actually reaches it, and where it runs. This is the list the Data Processing Addendum authorizes.
Current sub-processors
5 providers, as of the date above. Each one is here because Source calls it in production — not because it is installed, and not because we might use it one day.
| Provider | What it does | What reaches it | Where |
|---|---|---|---|
| Convex | The application database, file storage and backend functions. Everything in Source that is not a payment or an email lives here. | Account records, workspace content (tickets, pages, whiteboards, comments, attachments), agent session records, audit logs, notifications. | United States |
| Vercel | Hosting and content delivery for the web application itself. | Request metadata reaching the edge network — IP address, user agent, requested path. No workspace content is stored here. | United States, with a global edge network |
| Polar | Merchant of record for Pro subscriptions: checkout, card processing, invoicing, tax and the billing portal. | Name, email address, billing and tax details, seat count, subscription and invoice history. Card details go to Polar's payment processors and never reach us. | United States and the European Union |
| Resend | Transactional email: address verification, invitations, mentions and notifications, billing receipts, and support replies. | Recipient name and email address, and the contents of the message being sent. | United States |
| Upstash | A short-lived read-through cache in front of the agent and CLI endpoints, so a polling agent does not re-run a whole project read every time. | Cached project page text and board columns, held for at most five minutes and keyed by project, never by person. | United States |
Announced in advance
The Data Processing Addendum promises notice before a new sub-processor starts processing, and publishing it here is how that notice is given. Nothing in this section is in use yet.
| Provider | What it will do | What will reach it | Where |
|---|---|---|---|
| Sentry | Application error and performance monitoring, so a crash is seen rather than reported. | Error reports: stack traces, the route the error happened on, browser and OS, and the account id of the signed-in user. | European Union |
Third parties that are not sub-processors
These act on their own account rather than on our instructions, which makes them independent controllers rather than our processors. Calling them sub-processors would imply we direct what they do with your data, and we do not.
- Google — Optional sign-in provider. If you sign in with Google, Google decides on its own account how it handles that sign-in; it hands us a name, an email address and a profile picture.
- GitHub — Optional sign-in provider, and the source of build status for a project that connects a repository. A connected repository is read with a token you supply, under your own agreement with GitHub.
- Polar — As merchant of record, Polar is also a controller in its own right for the sale itself — it is the seller on your invoice and is responsible for the tax on it. Its role as our processor for customer records is the one listed above.
Your coding agents and their model providers
Anthropic, OpenAI, Google and whoever else your team’s agents talk to are not sub-processors of ours, and it would be misleading to list them. Your agent runs on your machine under your own account with that provider; Source receives the session metadata it reports — the tool, the ticket, the token counts — and never the conversation. We have no contract with your model provider and no visibility into your usage of it.
How this list changes
When we intend to add a sub-processor, it appears in Announced in advance with the date at the top of this page updated, at least 30 days before it starts processing. An organization that objects on reasonable data-protection grounds within that window should write to neuvikon@gmail.com; if we cannot offer a way forward that addresses the objection, the organization may terminate the affected part of the service and have the unused part of any prepaid fee refunded. That right is set out properly in clause 9 of the Data Processing Addendum.
We may replace a sub-processor with less notice where it is necessary to keep the service running or secure — a provider going dark, for instance. In that case we will update this page as soon as we can and say what happened.
To be told when this page changes rather than having to come back and check it, email us and ask to be put on the notice list.