Ekaya Cloud Subprocessors
Version 1.3, effective 2026-10-18.
This list names the subprocessors that Ekaya Inc, a Delaware corporation ("Ekaya"), whose address is 1112 Montana Ave #414, Santa Monica, CA 90403, engages to process personal data in Customer Content for Ekaya Cloud, and the providers and platforms involved with personal data about Ekaya Cloud users. Part A is Annex III of the Ekaya Cloud Data Processing Agreement and lists its Approved Subprocessors; Parts B to D are informational and are not Approved Subprocessors. Part E restates the notice that Section 1.4 of the Data Processing Agreement gives for changes to Part A. The Ekaya Cloud Privacy Policy refers to this page as a whole (Parts A and B). It covers Ekaya Cloud only. It does not apply to Ekaya Enterprise or to any Ekaya software that a customer runs in its own environment.
A. Subprocessors of Customer Personal Data (DPA Annex III)
The entries below are the Approved Subprocessors under DPA Section 11.
| Subprocessor | Purpose | Data touched | Location |
|---|---|---|---|
| Google (Google Cloud Platform) | Hosting the Region: Cloud SQL for Managed Project Databases and for Ekaya's platform metadata (datasource configuration and encrypted credentials, Requests, ontology, audit records); Cloud Run for Ekaya Admin, the Gateway and Data API, the Request Service and its sandboxed request runner; Secret Manager; Cloud KMS; load balancing; Cloud DNS; Cloud Logging | All Customer Content in a Project, including Customer Personal Data: Project data, engine metadata, encrypted datasource credentials, audit records, and the Request Service's sealed connection tokens | United States: us-central1 (Iowa) for databases and compute. Secrets use automatic replication, so Google chooses their locations. Logs are in Google Cloud's default logging location, which Ekaya has not pinned to the Region. Global load balancers terminate TLS at Google edge locations. |
| Google (Firebase and Identity Platform) | Ekaya Cloud's control plane: Firestore for Projects, membership, Roles, billing configuration, usage counters and event records; Identity Platform for sign-in; Firebase Hosting for the console | Project names and membership (names, email addresses, Roles of the Customer's users) and the Project identifiers in audit and event records. The same store holds account, invitation, billing and attribution records for which Ekaya is the controller (Part B row for Google). | Firestore: United States, us-central1, with point-in-time recovery. Identity Platform and Firebase Hosting: Google global services; Google chooses their processing locations |
| Composio — Sampark, Inc. dba Composio, a Delaware company, 2 Bryant St., Suite 220, San Francisco, CA 94105 | Connecting service datasources: the Customer's connections to third-party services (for example Google Ads and Google Analytics) are authorized through Composio's hosted link, the resulting credentials are held at Composio, and approved Requests to those services are executed through Composio's proxy | Project and connection identifiers, the asserted principal, the Customer's credentials for the connected service, tool arguments and proxied requests, and the connected service's responses, which can contain Customer Personal Data; the provider tokens are held at Composio, not by Ekaya | Not stated in Composio's data processing agreement; Composio lists its own subprocessors at https://trust.composio.dev/subprocessors |
| Twilio SendGrid | Service email: sign-in verification, invitations and notices; Trigger Email delivery of survey thank-yous | Recipient email addresses and names; message content, which can include Project names or a survey thank-you | Set by the provider |
B. Vendors involved with data about Ekaya Cloud users (Privacy Policy)
These vendors are involved with account, billing and usage data for which Ekaya is the controller. This list does not decide their role under privacy law. They receive no Customer Content, other than the Project's identifier and name, which Stripe holds as billing metadata.
| Provider | Purpose | Data touched | Location |
|---|---|---|---|
| Stripe | Payment processing, invoices, subscriptions | Billing Owner email and address, payment card details (collected by Stripe directly), plan, seats and payment status, subscription and invoice records, and the Project's identifier and name as customer metadata | Set by the provider |
| Google (Google Analytics 4) | Measuring use of the console, and measuring Google Ads campaigns (the property is linked to Google Ads) | Pseudonymous identifiers in cookies; the addresses of pages visited, which can carry ad click identifiers; events such as sign-up and Project creation, with campaign labels (Ekaya sends no click identifiers or account or Project identifiers as event details) | Set by the provider |
| Google (Google Ads) | Measuring Google Ads campaigns: conversions from Google Analytics, and offline conversions for qualified form requests (Privacy Policy Section 2.8). | Ad click identifiers (gclid, gbraid, wbraid), the time of the request and Ekaya's reference for it; Google Analytics conversion events |
Set by the provider |
| Google (Google Workspace) | Ekaya's email, including support@ekaya.ai | Support correspondence | Set by the provider |
| Twilio SendGrid | As in Part A | As in Part A | As in Part A |
| Microsoft (Entra ID and Azure SQL On-Behalf-Of) | Microsoft sign-in and the Azure SQL On-Behalf-Of exchange | Microsoft account identifier and profile data; the Microsoft access token used for the exchange; and the resulting Azure SQL access token that Central stores for the session | Set by the provider |
C. Model providers
Ekaya Cloud makes no Ekaya-side model calls, so this list names no model provider. Before Ekaya uses one for Ekaya Cloud, it will list it as a subprocessor, give notice under DPA Section 1.4, and update the Data Residency Statement.
D. Not subprocessors
- The Customer's own agent and model provider (for example the coding agent and model the Customer connects). The Customer chooses them, and the data they receive is the Customer's transfer (Terms Section 3.5).
- Sign-in providers the user chooses (Google and GitHub). They authenticate the user and share profile data with Ekaya; they receive no Customer Content. Microsoft is listed in Part B because Central also uses a Microsoft access token for the Azure SQL On-Behalf-Of flow.
- Infrastructure tooling (GitHub for source and deployment identity, HCP Terraform for infrastructure state). They hold no Project data.
E. Changes to this list
Ekaya gives at least 30 days' notice before a new subprocessor processes Customer Personal Data, by updating this list and emailing the Administrators of active Projects, as DPA Section 1.4 provides.