Legal
Subprocessors
Last updated October 22, 2026
1. Current subprocessors
A subprocessor is a third party SlashPeak, Inc. engages to help deliver the Service, and that may process customer data as a result. The table below lists every subprocessor we currently use, what we use it for, and what data it touches.
| Subprocessor | Purpose | Location | Data processed |
|---|---|---|---|
| Google Cloud Platform | Infrastructure hosting: the application servers, background workers, and our self-managed Postgres/TimescaleDB database run on Compute Engine; encrypted database backups are stored in Cloud Storage. | United States | All account, team, connection, scan, findings, and metric data, and all data transiting the application at request time. |
| Resend | Delivery of account, verification, and scan-report emails. | United States | Recipient email address and message content. |
| Loops | Delivery of onboarding, newsletter, and product-update emails, and their unsubscribe handling. | United States | Member name and email, account plan and trial dates, setup progress (connection count, first scan date), and email opt-ins. Never warehouse data or findings. |
| Dodo PaymentsOnly if you buy a paid plan | Reseller and Merchant of Record for paid plans: checkout, subscriptions, invoices, sales tax, and the billing portal. | United States and India | Account owner name and email, billing address, payment card details (collected by Dodo Payments directly, never stored by us), plan, and invoice history. |
| PostHog | Product analytics, error reports, and AI usage records (model, token counts, timing). | United States | Browser events and a visitor ID only if you accept analytics cookies; server-side product events, error reports, and AI usage records linked to your user ID. Never question or answer text from AI features, and never warehouse data. |
| Cloudflare | Network proxy and tunnel in front of the website and app (all traffic to the Service passes through it), and the Turnstile bot check on password sign-in, email sign-up, brochure requests, and support access. | United States | Traffic to and from the Service in transit, including IP addresses; and technical signals from your browser during a bot check. |
| Cal.comOnly if you book a demo | Hosts the booking calendar on our demo page, and sends the calendar invite and meeting link for a demo you book. | United States | Your name, work email, the meeting time and time zone, and the details you entered in the booking form. |
| Google Workspace (Google Calendar)Only if you book a demo | Our team calendar, which holds the demo meeting you booked through Cal.com. | United States | Your name, work email, and the meeting time. |
| Google and Microsoft (sign-in)Only if you sign in with Google or Microsoft | Lets you sign in with your Google or Microsoft account. | United States | Your name, email address, and account ID, sent to us by the provider when you sign in. |
| Google Cloud (Vertex AI) | Runs every AI model we use: Gemini for Cognis answers and the Cognis AI query optimizer, and Anthropic's Claude for Cognis's SQL fixes and Cognis AI DBA fixes. | United States | Your question text and the account metadata needed to answer it. For the query optimizer (only when a user clicks "Optimize with Cognis AI" on a query): that query's text with string literals and large numbers masked and comments removed, plus table schemas and sizes — never table contents. For AI-written fixes (only with your consent): the finding, the query text, the table schema, and the files being fixed. Not used to train the models. |
| GitHubOnly if you install the GitHub App | Reads the files Cognis AI DBA needs to fix, and opens pull requests for its dbt and code fixes, via our GitHub App. | United States | Repository metadata, the files read from the repositories you select (held in memory only, not stored), and the contents of the branches and pull requests our GitHub App creates. |
| SlackOnly if you configure a Slack webhook | Delivers scan and alert notifications to a channel you choose. | United States | The alert message content you've configured us to send. |
2. Changes to this list
We review this list whenever we add or remove a subprocessor. Customers who have signed a Data Processing Agreement and requested notice will be notified before a new subprocessor is engaged, with a reasonable window to object on legitimate grounds — see the DPA's Subprocessors section. Questions about a specific subprocessor can be sent to [email protected].
Questions about a subprocessor?
We're happy to walk through exactly what a specific vendor sees and why we use it.