Last changed: 31 October 2026. This English version is a courtesy translation; only the German version is legally binding.
This page lists the service providers that process personal data on kanman's behalf when we provide the service to our customers (sub-processors under Art. 28(2) and (4) GDPR). It is Annex 2 of the Data Processing Agreement. How we process data of visitors to this website and of account holders is described in the Privacy Policy.
1. Platform
We use these service providers for every customer.
| Service provider | Purpose | Data categories | Location / region | Transfers to third countries |
|---|---|---|---|---|
| Supabase, Inc., USA | Database, sign-in, file storage and server functions of the application | All data stored in kanman: accounts, workspaces, stories, runs, decisions, audit log, run artifacts, encrypted keys | Stored in Stockholm, Sweden (region eu-north-1). Server functions run on Supabase's edge network, usually close to the caller | EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) |
| Fly.io, Inc., USA | Cloud runner: one machine per run on which the coding agent works. Not used when all runs execute on the customer's own runners | Source code checked out for the run, run logs, content of the run's model calls | Frankfurt am Main, Germany (region fra) | EU Standard Contractual Clauses |
| Cloudflare, Inc., USA | Delivery of the website, the application and the documentation (Pages, CDN), DNS, attack protection, Workers, email forwarding (Email Routing) for addresses at kanman.ai, including replies to kanman emails | IP addresses and connection data, content of incoming emails | Global network; requests are usually handled in the nearest data center | EU-US Data Privacy Framework, EU Standard Contractual Clauses |
| Plus Five Five, Inc. (Resend), USA | Sending emails (sign-in, invitations, notifications, email digest) | Recipients' name and email address, email content, delivery status | Sent from Ireland (region eu-west-1); administration in the USA | EU-US Data Privacy Framework, EU Standard Contractual Clauses |
| Stripe Payments Europe, Limited, Ireland | Payment processing, subscriptions, invoices | Name, email address, billing address, payment data, contract and invoice data | EU; onward transfer to Stripe, Inc., USA | EU-US Data Privacy Framework, EU Standard Contractual Clauses |
| Google Ireland Limited, Ireland | Mailbox to which emails to [email protected] and [email protected] are forwarded (support) | Content of support requests and their attachments, sender data | EU and USA | EU-US Data Privacy Framework, EU Standard Contractual Clauses |
| Anthropic, PBC, USA | AI assistance (Claude) that the Provider uses for operations, troubleshooting and support. Data from the application may be processed in individual cases | The application data needed for the task at hand, for example logs, run data, account data | USA | EU Standard Contractual Clauses |
2. Model access through kanman
We engage a model provider only when a team uses model access through kanman instead of its own key. The provider then receives the prompts and the code and tracker context a step needs. With the customer's own key (BYOK), through the customer's AI gateway or through the model access of the customer's own runners, the model provider is the customer's own contractual partner and not a sub-processor of kanman.
| Service provider | Purpose | Data categories | Location / region | Transfers to third countries |
|---|---|---|---|---|
| Anthropic, PBC, USA | Model calls with Claude models | Prompts, source code excerpts, tracker content, logs a step needs | USA | EU Standard Contractual Clauses |
| OpenAI, L.L.C., USA | Model calls with OpenAI models (for example for Codex) | Prompts, source code excerpts, tracker content, logs a step needs | USA | EU Standard Contractual Clauses |
We do not use customer content to train AI models, and we use model access only on terms under which the provider does not use the data for training.
3. Not sub-processors
The customer chooses these recipients itself, or they work independently of us. Their own terms apply.
- Services the customer connects: for example GitHub, GitLab, Jira, Slack, Microsoft Teams or other extensions. kanman reads and writes there on the customer's behalf; the customer holds the contract with the service.
- Model providers with the customer's own key: Anthropic, OpenAI, Microsoft (Azure OpenAI), Amazon Web Services (Amazon Bedrock) or an AI gateway, under the customer's own contract.
- Self-hosted runners: run in the customer's infrastructure and under the customer's responsibility.
- Browser push services: when a user turns on push notifications, the push service of their browser (for example from Google, Apple, Mozilla or Microsoft) delivers them. The content is end-to-end encrypted.
- Unsplash: background images are loaded directly from Unsplash (see the Privacy Policy).
4. Changes to this list
Before we engage a new sub-processor or replace an existing one, we inform the owners of the workspaces by email at least 14 days in advance and update this page with the date. The customer can object within these 14 days in text form to [email protected] on reasonable data protection grounds. If we find no solution, the customer can terminate the affected services before the change without further cost. If a provider has to be replaced at short notice (for example because it discontinues its service, or for security reasons), we inform without undue delay; the right to object and to terminate then runs from the notice.
5. Change history
- 31 October 2026: list published as its own page. Newly listed: Google (support mailbox) and Anthropic (AI assistance in operations); Resend sends from the EU region.