Subprocessors
Last updated: 10 August 2026
Sonata uses the third-party services below to provide the product. Each processes a specific, limited category of data on Sonata’s behalf. Sonata does not sell your data to any of these services, and none of them may use your data to train their own models beyond what is described here. Full detail (lawful basis, retention per activity) lives in our internal Records of Processing Activities; questions welcome at privacy@sonatai.co.
| Service | Purpose | Data categories | Region | DPA status |
|---|---|---|---|---|
| Anthropic (Claude) | Chat, brief generation, drafting, extraction | Email snippets, calendar, contacts, chat, strategy | US | Standard termsNo-train commitment confirmed in Anthropic’s commercial terms |
| Voyage AI | Text embeddings for semantic search | Knowledge/text chunks | US | Standard terms |
| Perplexity (Sonar) | Background research queries | Query text (business context) | US | Standard terms |
| Google (Gmail / Calendar) | Source integration you connect | OAuth-scoped mailbox/calendar content | US / global | OutstandingGoogle API terms accepted at connect time; platform verification in progress |
| Xero | Accounting source integration you connect (read-only) | Invoice amounts/due dates, debtor names (receivables), cash position | Global | OutstandingXero API terms accepted at connect time; partner certification is the scale gate |
| Microsoft (Graph) | Source integration you connect | OAuth-scoped mail/calendar content | US / global | OutstandingPublisher verification in progress |
| Meta (WhatsApp Cloud API) | WhatsApp channel integration | Message content, phone numbers | US / global | OutstandingApp review in progress |
| Neon | Primary database | All tenant data | EU regions | Standard terms |
| Vercel | Application hosting + file storage (Blob) | Requests, logos, exports, contract documents | Edge / US | Standard terms |
| Upstash | Rate limiting, OAuth-state protection, durable job queue | Keys, nonces, job payload references | Region-configured | Standard terms |
| Paddle | Billing (merchant of record) | Billing/customer data — no card data reaches Sonata | US / UK | Standard terms |
| Sentry | Error tracking | Scrubbed error context — no message bodies | US / EU-configured | Standard terms |
| Langfuse | LLM observability | Operation IDs and counts — no prompt or completion content | Configured | OutstandingRetention terms being verified; content recording is off by default |
| Resend | Transactional email | Email address, verification/reset links | US | Standard terms |
Standard termsmeans the vendor publishes data-processing terms that apply to Sonata’s account. Outstandingmeans that vendor’s own review or verification step is not finished yet — the service is in use under its platform terms while that completes. Neither status claims a separately negotiated, countersigned agreement; where one exists we will say so and date it.
International transfers
Most of the services above are US-headquartered. Transfers rely on the UK extension to the EU–US Data Privacy Framework, or on the vendor’s own standard contractual clauses, per that vendor’s terms.
Changes
We’ll update this page when a subprocessor is added, removed, or changes purpose. Material additions get an email to active users ahead of the change taking effect.
Your rights
See our Privacy Policy for the full picture of what we collect, why, and your rights under UK GDPR (access, correction, deletion, portability, and the right to complain to the ICO).