Sub-processors
Last updated · Circo, Inc.
In plain English
- Capable uses ten sub-processors. Each one is listed below with what it does, what data it touches, and where.
- Everything that holds cap table data is hosted in the United States.
- Finch is used only if your company connects an HR system. AI providers receive data only when someone uses an AI feature.
- We give 30 days’ notice before adding a new sub-processor, and you can object.
This summary helps you read the document. The numbered sections below are what bind.
1. Current sub-processors
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Vercel Vercel Inc. | Application hosting, content delivery, legacy file storage, and the AI Gateway that routes AI requests to model providers | All customer data in transit through the application; files uploaded before our storage migration; AI prompts and outputs in transit | United States |
| Turso ChiselStrike, Inc. | Primary database | All structured customer data: accounts, companies, stakeholders, securities, transactions, audit log | United States (AWS us-west-2) |
| Railway Railway Corporation | Private S3-compatible file storage and Redis cache | Uploaded documents, signed agreements, certificates, import files; short-lived cached application data | United States |
| Stripe Stripe, Inc. | Subscription billing and payment processing | Billing contact name and email, company name, payment method details (held by Stripe, not by us), invoices | United States |
| Resend Plus Five Five, Inc. | Transactional email delivery | Recipient name and email address, email content such as sign-in links, invitations, signature requests, and notices | United States |
| OpenAI OpenAI, LLC | AI model provider for the in-app assistant, import mapping, and connector features, reached through Vercel AI Gateway | The portion of customer data needed to answer a specific AI request, and the resulting output | United States |
| Anthropic Anthropic, PBC | AI model provider for the in-app assistant, import mapping, and connector features, reached through Vercel AI Gateway | The portion of customer data needed to answer a specific AI request, and the resulting output | United States |
| Google Google LLC | Sign in with Google | Name, email address, and profile identifier of users who choose Google sign-in | United States |
| Finch Finch | HRIS and payroll connectivity, only for companies that connect an HR system. Optional. | Employee names, work emails, job titles, employment start and end dates | United States |
| Cloudflare Cloudflare, Inc. | DNS for capable.so | IP addresses of devices resolving our domain; no cap table or stakeholder content | Global network |
A sub-processor is a third party that processes customer personal data on our behalf. The list excludes services that never receive customer data, such as our internal productivity tools.
2. How we choose and bind sub-processors
We review each provider’s security and privacy practices before we use it. Each is bound by a written data processing agreement with obligations no weaker than our own Data Processing Addendum, including Standard Contractual Clauses where international transfers occur. We remain responsible to you for their performance.
3. Services you connect yourself
When you connect Capable to a service under your own account, such as Claude, ChatGPT, your identity provider for single sign-on, or your law firm’s systems, that service acts for you, not for us. It is not our sub-processor, and your agreement with it governs the data it receives.
4. Changes and objections
We give at least 30 days’ notice before a new sub-processor starts processing customer personal data. We update this page and email the owners of paying workspaces. Anyone else can receive the same notices by emailing privacy@capable.so with the subject “Subscribe to sub-processor updates”.
If you have a reasonable data protection concern about a new sub-processor, email us within the notice period. We will work with you in good faith. If we cannot resolve it, you may end the affected service and receive a pro-rata refund, as described in Section 6 of the DPA.