Sub-processors
This page lists the third parties that Codia Tech, LLC ("Codia") uses to process personal information in connection with the Services ("sub-processors"). It is part of our Privacy Policy and our Data Processing Addendum. We will give at least 30 days' advance notice of any material change by updating this page and — for subscribers — by email or in-product banner.
If you are an enterprise customer and reasonably object to a new sub-processor on data-protection grounds, you may terminate your paid subscription and receive a pro-rated refund.
Infrastructure
| Sub-processor | Purpose | Processing region | Safeguards |
|---|---|---|---|
| Amazon Web Services, Inc. | Cloud compute, object storage (S3), PostgreSQL, Redis, networking | United States (us-west-1) | 2021 EU SCCs; AES-256 at rest; VPC isolation |
| Cloudflare, Inc. | CDN, DDoS protection, WAF | Global edge (routing only) | 2021 EU SCCs |
| Qdrant Solutions GmbH | Vector database (agent RAG) | Germany (eu-central) | EU SCCs |
Payments
| Sub-processor | Purpose | Region | Safeguards |
|---|---|---|---|
| Stripe, Inc. | Card processing, subscription billing, tax | United States (Stripe Ireland for EU customers) | PCI-DSS Level 1; 2021 EU SCCs; Stripe DPA |
Foundation-model providers
All model providers below operate under contractual no-training commitments for API inputs and outputs unless you explicitly opt in.
| Sub-processor | Models used | Processing region | Retention |
|---|---|---|---|
| OpenAI, LLC | gpt_image, GPT family text models | United States | 0–30 days abuse-monitoring; no training on API data |
| Google LLC | Gemini family, nano_banana_2, nano_banana_pro, Imagen | United States | 0 days on paid tier; no training per Vertex AI / Gemini API commercial terms |
| Anthropic, PBC | Claude family | United States | 30 days; no training on API inputs by default |
| Black Forest Labs GmbH | flux_2_pro, flux_2_max | Germany / United States | Per BFL DPA; no training on API data |
| Recraft AI | recraft_v4 | United States | Per Recraft enterprise terms |
| Ideogram, Inc. | ideogram_v3 | United States | Per Ideogram API terms |
| ByteDance (SeeDream) | seedream_5, seedream_4_5 | Singapore (routed via regional endpoint) | No routing to China for non-China users; per ByteDance enterprise API terms |
Your options. If you do not wish your inputs to be routed to a specific provider for a specific feature, contact [email protected]. For certain tasks, routing to an alternative provider is available on our enterprise plan.
Communications
| Sub-processor | Purpose | Region | Safeguards |
|---|---|---|---|
| Amazon SES (Amazon Web Services, Inc.) | Transactional email — account verification, password reset, billing receipts, incident notifications | United States | 2021 EU SCCs; AWS DPA |
Analytics & observability
Codia does not use any third-party product-analytics vendor. Feature-usage metrics are computed in-house on AWS infrastructure and retained only in aggregated form that cannot identify an individual user.
Operational error-tracking and observability are performed within our own AWS environment; no crash telemetry is sent to third-party services.
Updated: April 22, 2026. Questions: [email protected].