Sub-processors

About this list

This is the list of sub-processors referenced by Clueso’s Data Processing Agreement and Privacy Policy. Changes are posted here at least ten (10) business days before they take effect, and customers under a Data Processing Agreement may object within ten (10) business days of an update, on the terms set out in that agreement. Subscribe below to be notified when this list changes.

Changes in this update (8 October 2026)

Added HeyGen, Inc. (avatar generation), Browserbase, Inc. and Anthropic, PBC (Automated Recording), and Loops (email delivery). These providers were already engaged in the Service, so this update brings the list up to date and takes effect on publication rather than ten (10) business days later. Customers under a Data Processing Agreement may object within ten (10) business days of this update, on the terms set out in that agreement.

1. How this list is scoped

Sub-processors are scoped to the modules a customer has enabled. A customer using hosting only receives a materially shorter list than one using recording and generation. The platform group applies to everyone.

Customer-connected integrations are not sub-processors and are not listed here. Where a customer connects a third-party platform, the customer holds the agreement and the credentials and the content goes into that customer’s own tenant. See Section 6.

2. Platform

Engaged for every customer, including hosting-only.

3. Transcription, generation and media

Engaged where the customer records or generates content. Not engaged for hosting-only customers. Multiple providers are retained per capability for redundancy and quality; where a customer restricts Clueso to an approved subset, calls to the remaining providers are excluded for that workspace.

4. Automated Recording

Engaged only where Automated Recording is enabled. See the corresponding annex in the customer’s Data Processing Agreement for full detail.

5. Code-Connected Content Generation

Engaged only where Code-Connected Content Generation is enabled. See the corresponding annex in the customer’s Data Processing Agreement for full detail.

6. Customer-connected integrations

Clueso supports integrations that publish generated content into a platform the customer already uses, such as a documentation or help-centre platform. These are not sub-processors. The customer chooses and connects the integration, holds the account and the credentials, and the content is written into the customer’s own tenant under the customer’s own agreement with that provider.

Clueso does not appoint these providers, does not assess them, and does not determine their security, retention or sub-processing practices. Connecting or disconnecting one is within the customer’s control and is not a sub-processor change, so it does not trigger the notice and objection process above. The integrations available to a customer are shown in the product.

The same applies to an AI assistant that a user connects to Clueso through the Clueso connector. The user chooses the assistant and uses it under their own agreement with its provider, so it is not a Clueso sub-processor.

7. Controls applying to all sub-processors

These apply to the sub-processors in the sections above. They do not apply to customer-connected integrations, which Clueso does not appoint and does not assess.

• Diligence before engagement — security posture, certifications such as SOC 2 and ISO/IEC 27001, data-residency arrangements and contractual data-protection commitments are assessed before a sub-processor is engaged.
• Written data processing agreements — covering confidentiality, security, purpose limitation, breach notification and data-subject rights.
• Standard Contractual Clauses — where the sub-processor processes personal data of individuals in the EEA, UK or Switzerland, together with the UK International Data Transfer Addendum where applicable. Copies are available to customers on request.
• No training on customer data — AI sub-processors confirm in writing that Clueso customer content will not be used to train any generalised model, will be retained only as long as necessary to deliver the requested processing, and will be deleted consistent with Clueso’s retention schedule.
• Server-side calls only — all sub-processor calls are made by the application backend. Provider credentials never leave the backend.
• Annual review — of all AI vendors for continued compliance with security standards and regulatory requirements.

8. Data residency

Customer content and the stores holding it are localised to the region the customer selects: Mumbai (ap-south-1), Frankfurt (eu-central-1) or California (us-west-1). Account identity data — name, work email and organisation, containing no customer content — is held in a single global store.

The AI sub-processors above are United States services, so at the AI processing step content is transferred outside its storage region. These transfers are covered by data processing agreements incorporating Standard Contractual Clauses where applicable.

9. Retention

AI sub-processors do not retain or reuse customer content beyond the defined processing request. Within Clueso, content marked for deletion by the customer is securely deleted or anonymised within a maximum of thirty (30) days.

10. Contact

Information Security Officer
privacy@clueso.io
Desklamp, Inc. d/b/a Clueso