Eklo Subprocessors (0.9 private beta)
Last updated
Eklo uses nine subprocessors during the 0.9 beta, including Stripe for billing and sales tax, and Google and Apple as independent providers for optional sign-in. All are checked against the code and Eklo's own accounts. Effective date: November 3, 2026.
| Provider | Purpose | Data involved | Location | Privacy and DPA | In the beta |
|---|---|---|---|---|---|
| Amazon Web Services | Hosting: servers, database, queues, self-hosted realtime updates, file storage (S3) with short-lived signed links for files and thumbnails, malware scanning of uploaded files (GuardDuty), database backups (S3), content delivery (CloudFront) and firewall (WAF), logs (CloudWatch), secrets (Secrets Manager), alarm emails to Eklo staff (SNS), and this website | All account and church data; database backups; application logs, scrubbed of emails, tokens and IP addresses; firewall logs with the IP addresses of blocked or flagged requests | US East, us-east-1 (Northern Virginia); CloudFront also serves the app and this website from edge locations worldwide. | Privacy Notice · GDPR Center and DPA | Active |
| Resend (Plus Five Five, Inc.) | Sends sign-in codes and links, workspace invitations, beta-approval emails, direct-message and away notifications, notification digests, questions to form submitters, submission decisions, workflow emails, Ask Eklo reminders, export-ready notices, account-deletion codes and service notices to workspace owners | Recipient email addresses and email content | United States | Privacy Policy · DPA | Active |
| OpenAI | AI provider for Ask Eklo, the AI assistant, including the images it makes, and Library image tagging (see below) | Prompts, workspace content Ask Eklo retrieves, attached files, remembered notes, image descriptions, images, AI output | United States | DPA · Enterprise privacy | Active |
| Anthropic | AI provider for Ask Eklo, the AI assistant, including the web searches it runs, and Library image tagging (see below) | Prompts, workspace content Ask Eklo retrieves, attached files, remembered notes, web search words and addresses, images, AI output | United States | Privacy Policy · DPA | Active |
| Braintrust (Braintrust Data, Inc.) | Traces a sample of Ask Eklo requests to monitor how AI features perform | AI model, tool names, content kinds and sizes, token counts and timing. No prompts, workspace content, AI output or user or workspace identifiers | United States | Privacy Notice · DPA | Active; about 5% of Ask Eklo requests are traced |
| Sentry (Functional Software, Inc.) | Error reporting for the web app, API and workers; no performance tracing | Error messages, stack traces, request route, browser and device data; may include identifiers that appear in errors | United States and other countries where Sentry's subprocessors operate | Privacy Policy · DPA | Active |
| Cloudflare (Turnstile) | Bot checks on public forms and the request-access form | Visitor IP address, TLS fingerprint, browser user agent, site key and page origin | Cloudflare's global network | Turnstile Privacy Addendum · DPA | Active; required in production |
| Google Workspace (Google LLC) | Email for Eklo's own addresses, such as hello@eklo.io and privacy@eklo.io: support, privacy and security requests | Senders' names and email addresses, and what they write to us | United States and other countries where Google operates | Privacy Policy · Cloud Data Processing Addendum | Active |
| Stripe | Subscription billing, payments and the billing portal; sales tax calculation (Stripe Tax) | The church's legal name, billing address and owner's email, whether the church is tax-exempt, plan and subscription, and payment details entered with Stripe | United States and other countries | Privacy Policy · DPA | Active |
| Optional "Continue with Google" sign-in | Name, email, profile image, Google account ID and the sign-in tokens Google returns | Google's infrastructure; Google acts as an independent sign-in provider | Privacy Policy | Optional | |
| Apple | "Sign in with Apple" | Name, email or relay address, Apple ID token | Apple's infrastructure; independent sign-in provider | Privacy Policy | Not active: the code supports it, but deployed config doesn't set it up |
Ask Eklo, and Library image tagging once the Library is available, use OpenAI and Anthropic. We choose which one answers Ask Eklo, may switch from one to the other at any time, and may use each for a different feature; both are listed here so a switch doesn't change who can receive this data. As Eklo is set up, Anthropic answers Ask Eklo and OpenAI makes its images, so both receive Ask Eklo data at the same time: OpenAI gets the description of each image someone confirms, which can include workspace content. Ask Eklo searches the web only while Anthropic answers it, and Anthropic, not Eklo, runs those searches and opens those pages.
Realtime updates (chat messages, notifications and live updates) run on our own servers at Amazon Web Services, not a third-party service. We will give at least 15 days' notice before adding or replacing a subprocessor, by email to each workspace owner and an update to this page. Anyone else who wants to hear about changes can email hello@eklo.io.
How Eklo protects church data, in plain words, is on the Security page.