Subprocessors
Owndevice, Inc. ("Grounds") uses a small set of infrastructure providers ("Subprocessors") to operate the Grounds service. This page lists each Subprocessor, what they do, where they process data, what categories of data they touch, and whether the customer can opt out.
This page is the maintained list of Subprocessors. A Data Processing Agreement is available upon request — contact legal@grounds.ai. We will provide at least 30 days' advance notice of any new Subprocessor; customers may subscribe to notifications as described below.
Current Subprocessors
| Subprocessor | Purpose | Data categories | Region | Customer opt-out | Terms |
|---|---|---|---|---|---|
| Amazon Web Services, Inc. (Bedrock) | AI inference (zero-retention, no-training) | Customer Personal Data (prompts and outputs) | U.S. East | No — core to Service | aws.amazon.com/service-terms |
| Anthropic (Claude models) | AI inference — primary model family, served entirely through AWS Bedrock in U.S. regions; prompts and outputs are not shared with Anthropic the company and are not used for training (zero retention) | Customer Personal Data (prompts and outputs, within AWS Bedrock only) | U.S. | No — core to Service | aws.amazon.com/service-terms |
| Moonshot AI (Kimi models) | AI inference — cost-efficient background tasks, served entirely through AWS Bedrock; data never reaches Moonshot AI the company. Claude-only processing is available on request | Customer Personal Data (prompts and outputs, within AWS Bedrock only) | U.S. | Yes — request Claude-only processing | aws.amazon.com/service-terms |
| Tavily, Inc. | Web search for AI research features — receives the search query only, and only when web search is used; never receives documents | Search queries (guarded against inclusion of document text) | U.S. | Yes — by not using web search | tavily.com/privacy |
| Free Law Project (CourtListener) | Public case-law lookups via our research service — receives search queries and citations only, never client documents | Case-law search queries and citations only | U.S. | Yes — by not using case-law research | free.law/terms |
| Amazon Web Services, Inc. (SES) | Transactional and notification email | Recipient name, email address, message body | U.S. East | No — core to Service | aws.amazon.com/service-terms |
| Supabase, Inc. | Managed Postgres hosting (primary data store) | Customer Personal Data (documents, embeddings, account data) | U.S. East | No — core to Service | supabase.com/legal/dpa |
| Fly.io, Inc. | Application and API hosting | Customer Personal Data (in-transit, ephemeral) | U.S. multiple | No — core to Service | fly.io/legal/dpa |
| Vercel, Inc. | Marketing site and static asset hosting | Operational telemetry only (no Customer Personal Data) | Global edge | No — marketing site only | vercel.com/legal/dpa |
| Cloudflare, Inc. | DNS, CDN, WAF, and access logs | Request metadata (IP, user-agent); not request bodies for application API | Global edge | No — core to Service | cloudflare.com/cloudflare-customer-dpa |
| Clerk, Inc. | Identity, authentication, and organization management | Account data (name, email, org membership, MFA factors) | U.S. | No — core to Service | clerk.com/legal/dpa |
| Stripe, Inc. | Payment processing and subscription billing | Billing contact, payment-method metadata (no raw card numbers) | U.S. | Only by not subscribing to a paid plan | stripe.com/legal/dpa |
Categories explained
- Customer Personal Data — the documents, redlines, prompts, AI outputs, and account information you submit to the Service, including personal data of third parties that appears in uploaded documents. The canonical definition is in our Data Processing Addendum (available on request).
- Operational telemetry only — non-content signals such as request volume, latency, and error rates. These do not include the substance of your documents or prompts.
How to subscribe to updates
Email subprocessors@grounds.ai from a domain associated with your account, with the subject line "Subscribe". You will receive advance notice of any addition, removal, or material change to this list at least 30 days before the change takes effect. Customers may object to a new Subprocessor on reasonable grounds as described in the DPA.
International transfers
Where Customer Personal Data is transferred from the EEA, UK, or Switzerland to the United States or other jurisdictions, the transfer mechanisms in Section 6 of our Data Processing Addendum (available on request) apply (EU Standard Contractual Clauses and the UK International Data Transfer Addendum).
Contact
Questions or objections? subprocessors@grounds.ai.