- When we add or replace a subprocessor that processes customer data, we update this page and revise the “Last updated” date above.
- To request advance notice of subprocessor changes, or for any data-protection question, email privacy@waystationai.com.
- For more on how we protect your data, see our Security and Privacy pages.
Security
Subprocessors
Last updated: June 22, 2026
To deliver the Waystation platform, we rely on a small set of trusted third-party service providers — “subprocessors” — that may store or process customer data on our behalf. This page lists every subprocessor we use, what each one does, and the data it handles.
Before engaging any subprocessor, Waystation AI, Inc. evaluates its security, privacy, and confidentiality practices and binds it to data-protection obligations consistent with the commitments we make to our customers. Our AI subprocessors are contractually prohibited from using customer data to train their models.
Infrastructure
Platform infrastructure.
The core services Waystation runs on. These process data across the whole platform.
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Vercel Vercel Inc. | Application hosting, serverless compute, and document file storage | Application request data; uploaded documents and attachments | United States |
| Amazon Web Services (AWS) Amazon Web Services, Inc. | Cloud infrastructure, compute, and application hosting | Application data and customer content hosted on cloud infrastructure | United States |
| Neon Neon Inc. | Managed PostgreSQL database — primary application data store | All customer account and application data | United States |
| Clerk Clerk Inc. | Authentication, user management, and session handling | User identity, email addresses, and authentication credentials | United States |
| Inngest Inngest Inc. | Background job and workflow orchestration | Event payloads referencing customer records | United States |
Application
Application services.
Services that power specific features — email processing, document extraction, and product monitoring.
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Google (Gemini API) Google LLC | AI processing of supplier email content — extraction, normalization, and item matching | Supplier email content submitted for processing | United States |
| Anthropic Anthropic PBC | AI processing of supplier email content (fallback model) | Supplier email content submitted for processing | United States |
| OpenAI OpenAI, L.L.C. | AI processing and text embeddings for supplier email content | Supplier email content submitted for processing | United States |
| Braintrust Braintrust Data Inc. | LLM gateway, prompt management, and request tracing for email processing | Email content routed to LLMs, and request/response traces | United States |
| Nylas Nylas Inc. | Email synchronization and sending on connected mailboxes | Email content, attachments, and sender/recipient metadata | United States |
| Resend Resend Inc. | Transactional and notification email delivery | Recipient email addresses and notification content | United States |
| Extend AI Extend | Document classification and structured data extraction | Supplier documents and their extracted contents | United States |
| Datadog Datadog Inc. | Application performance monitoring, logging, and error tracking | Operational logs, performance metrics, and client telemetry | United States |
| Pendo Pendo.io Inc. | Product usage analytics | Product usage events and session metadata | United States |
Location indicates each provider’s primary data-processing region. Providers may operate additional regional infrastructure.
Changes
Updates to this list.
We may update our subprocessors as the product evolves.