Subprocessors
OllyGarden, Inc. | Last Updated: October 6, 2026
OllyGarden, Inc. uses the third parties below to process customer data, such as telemetry, source code, and account information, on our behalf under applicable contractual terms. Transfers outside the European Economic Area rely on the EU-U.S. Data Privacy Framework where the provider is certified, on an adequacy decision, or on the European Commission's Standard Contractual Clauses.
Rose uses OpenRouter to access OpenAI and Anthropic models. By default, those providers do not use inputs or outputs to train their models, but standard API retention may apply for up to 30 days. Zero-data-retention routing and EU-only processing are separate Enterprise add-ons available on request. We do not use customer code or data to train models on any plan.
We update this list before a new subprocessor begins processing customer data. To be notified of changes, email [email protected] with the subject “Subprocessor updates”. How we handle personal data is described in our Privacy Policy.
Platform infrastructure
Used by Insights and Rose to host and operate the OllyGarden platform.
| Subprocessor | Purpose | Location |
|---|---|---|
| Google Cloud Platform | Hosting, storage, and encryption keys for the platform and telemetry analysis | Netherlands (europe-west4) |
| Amazon Web Services | Cloud infrastructure | Germany (eu-central-1) |
| Supabase | Application database | Germany (eu-central-1), Sweden (eu-north-1) for Rose |
| ClickHouse | Telemetry analysis database | Netherlands (Google Cloud europe-west4) |
| Cloudflare | DNS, network protection, and the Rose control plane | Global network; Rose control-plane services use the EU jurisdiction |
| Netlify | Delivery of the web application | United States, global edge network |
| Clerk | User authentication | United States |
| Stripe | Billing and payment processing | United States |
| Resend | Transactional email | United States |
| PostHog | Product analytics, session recordings with masked text, and error monitoring | EU (Germany) |
| Datadog | Monitoring of our own services; Rose traces can include excerpts of analyzed code | EU (datadoghq.eu) |
| Google (Gemini API) | AI-generated summaries of Insights findings | United States |
| Grafana Labs | Monitoring of our own services and on-call alerting; Rose traces can include excerpts of analyzed code | United Kingdom (London) |
Rose
Used by the managed GitHub App when Rose analyzes a connected repository. Locations describe the default configuration; an agreed EU-only configuration covers AI processing, managed sandboxes, storage, and telemetry.
| Subprocessor | Purpose | Location |
|---|---|---|
| GitHub | Source of repository code and destination for Rose issues and pull requests | As configured by the customer with GitHub |
| E2B | Isolated sandboxes that clone and analyze repositories | Managed United States region by default; no more-specific subregion is pinned |
| OpenRouter | Gateway for OpenAI and Anthropic model requests; optional EU and zero-data-retention routing | Provider-managed by default; EU endpoints under an agreed EU-only configuration |
| Amazon Web Services (Bedrock) | Hosting for some Anthropic model inference | Provider-managed by default |
| OpenAI | AI model inference through OpenRouter | Provider-managed by default; EU endpoints under an agreed EU-only configuration |
Support and business operations
Used when customers contact us or work with our team.
| Subprocessor | Purpose | Location |
|---|---|---|
| Google Workspace | Email and documents | United States, EU |
| Slack | Shared support channels and internal communication | United States |
| HubSpot | Customer relationship management | United States, EU |