Subprocessors
Effective date: October 31, 2026
This page lists the third-party subprocessors Watari engages to operate the Service. Each subprocessor processes Customer Content only as necessary to deliver the function described and only under a data-processing agreement that imposes obligations equivalent to those Watari undertakes in its Data Processing Agreement.
We provide at least 30 days' advance notice before adding or replacing a subprocessor. Subscribe to change notifications by emailing subprocessors@watari.ai with the subject “subscribe”.
AI
| Name | Purpose | Data | Location | Transfer | Added |
|---|---|---|---|---|---|
| Anthropic, PBC | Large language model (Claude API): bug extraction, matching bugs to code, pull-request drafting, root-cause analysis generation | Support ticket text, conversation threads, ticket attachments, code excerpts, extracted bug fields | USA | SCC Module 3 + Anthropic DPA + no-training contract | 2026-03-01 |
| OpenAI, L.L.C. | Embedding API (text-embedding-3-small): vector embeddings to match bugs to code and group duplicate reports. Speech-to-text API: transcription of audio in ticket attachments | Source code chunks (text), extracted bug fields, audio from ticket attachments (voice notes, screen-recording soundtracks) | USA | SCC Module 3 + OpenAI API DPA + 30-day abuse-monitoring retention | 2026-03-01 |
| TypeSafe AI (Jev), via Vercel AI Gateway | Decision model: matching bugs to code | Extracted bug fields (title, description, engineer-added context, file paths and error names found in attachments) and a small number of source code excerpts with their repository names and file paths, processed per request | Not stated by the provider | Reached through Vercel AI Gateway (Vercel DPA); the provider's website states requests are not used for training | 2026-10-02 |
Infrastructure
| Name | Purpose | Data | Location | Transfer | Added |
|---|---|---|---|---|---|
| Supabase, Inc. | Primary database (Postgres), auth, and object storage | All Customer Content | United States (AWS us-east-1) | SCC Module 2 + UK IDTA + DPDP Act §16 cross-border framework, all covered by Supabase DPA | 2026-01-01 |
| Vercel Inc. | Application hosting, edge functions, deployments | Application traffic, request logs, deployment metadata | USA / Global edge | SCC Module 2 + Vercel DPA | 2026-01-01 |
| Inngest, Inc. | Background job orchestration (the AI pipeline) | Job payloads (may include support ticket fragments during pipeline runs) | USA | SCC Module 2 + Inngest DPA | 2026-01-01 |
Authentication
| Name | Purpose | Data | Location | Transfer | Added |
|---|---|---|---|---|---|
| Google LLC ("Sign in with Google") | OAuth-based authentication when a user chooses "Continue with Google" on the Watari login or signup page. Watari receives the user's email address and (where available) full name from Google to provision the Watari account; no Google product data is fetched. | Email address, full name (read-only at sign-in) | USA | SCC Module 2 + Google Cloud DPA | 2026-05-24 |
| Microsoft Corporation ("Sign in with Microsoft", Microsoft Entra ID) | Identity check when an owner or admin connects a Microsoft Teams team to a Watari workspace, or when a person links their Teams account to their Watari account. Watari requests the openid and profile permissions only and keeps the Microsoft tenant ID and account object ID from the sign-in; it is not used to sign in to Watari and no other Microsoft data is fetched. | Microsoft tenant ID and account object ID (read at sign-in) | USA / Global | SCC Module 2 + Microsoft Products and Services Data Protection Addendum | 2026-10-31 |
| Cloudflare, Inc. (Turnstile) | Bot and abuse protection on the signup, login, password-reset, and contact-sales forms. Replaces traditional CAPTCHA. Watari configures the widget in Invisible mode, visitors see no challenge UI; Cloudflare performs the bot check silently. Watari does not receive raw browser fingerprints, only a short-lived verification token consumed once at submit. Cloudflare's own data handling for Turnstile is described in the Turnstile Privacy Addendum: https://www.cloudflare.com/application-services/products/turnstile-privacy-addendum/ | Client IP address, browser environment signals (analysed by Cloudflare, not transmitted to Watari), single-use verification token | USA / Global edge | SCC Module 2 + Cloudflare DPA + Turnstile Privacy Addendum | 2026-05-24 |
Communications
| Name | Purpose | Data | Location | Transfer | Added |
|---|---|---|---|---|---|
| Microsoft Corporation (Microsoft Teams, Azure Bot Service) | Delivery of Watari issue cards to the Microsoft Teams channel a workspace chooses, replies in the card thread, and the button presses and form answers a person sends back from a card, through the Microsoft Bot Framework. Used only by workspaces that add the Watari app to Microsoft Teams. | Issue card text (issue title, current step, short summary, link to Watari), answers typed into card forms, Microsoft tenant, team, channel and account identifiers, Teams display names | USA / Global | SCC Module 2 + Microsoft Products and Services Data Protection Addendum | 2026-10-31 |
| Resend, Inc. | Transactional email delivery | Email address, subject line, message body | USA | SCC Module 2 + Resend DPA | 2026-02-01 |
Billing
| Name | Purpose | Data | Location | Transfer | Added |
|---|---|---|---|---|---|
| Razorpay Software Pvt Ltd | Payment processing, subscription billing, invoicing | Billing contact, billing address, GSTIN, payment method (held by Razorpay; never stored on Watari servers) | India | In-country; PCI-DSS scope offloaded to Razorpay | 2026-01-01 |
Analytics
| Name | Purpose | Data | Location | Transfer | Added |
|---|---|---|---|---|---|
| Functional Software, Inc. (Sentry) | Error monitoring and performance telemetry | Error stack traces, request IDs, error contexts (PII scrubbed before transmission where present) | USA | SCC Module 2 + Sentry DPA | 2026-02-01 |
| PostHog Inc. | Product analytics inside the signed-in application: feature usage, activation and retention. Loads only after the visitor grants analytics consent, and stores its identifier in localStorage rather than a cookie. | Page views, event metadata, anonymous device identifiers | USA | SCC Module 2 + PostHog DPA; consent-gated for EU/UK visitors | 2026-02-01 |
| Google LLC (Google Analytics 4) | Acquisition analytics on the public marketing pages and the signup and login pages only: page views, referrer and campaign source, and the signup conversion. Not present inside the signed-in product. Runs under Google Consent Mode: where prior consent is required, and until it is given, the tag sets and reads no cookie and creates no identifier, and sends only cookieless requests. | Page views, referrer and campaign parameters, approximate location derived from IP, anonymous device identifiers (_ga cookies) | USA | SCC Module 2 + Google Ads Data Processing Terms; EU-US Data Privacy Framework; device storage consent-gated for EU, EEA, UK and Swiss visitors | 2026-09-05 |
| Better Stack (partial) | Uptime monitoring (heartbeat receiver active). Status page + on-call alerting **configured but not yet exercised**, endpoints reserved; outbound posting code lands in Prompt 20. | Heartbeat events, response codes, alert metadata | EU | In-EEA; no transfer mechanism required | 2026-04-01 |
Affiliates
BttrLabs Private Limited may engage its own affiliates as subprocessors. As of the effective date above, BttrLabs has no affiliates engaged in processing Customer Content.
Change log
Previous versions of this page are available on request to privacy@watari.ai. Material changes (additions, replacements) are also logged in the git history of this page in the Watari source repository.