Sub-processors
The third parties that process personal data on Isolation's behalf, what each does, and where it is.
Version 1.0 — 11 October 2026
The third parties that process personal data on our behalf to provide Isolation Cloud, what each one does, and where it is. This list is part of the Privacy Policy (isolation.cloud/legal/privacy). We email organizations' owners before adding a sub-processor that will handle Customer Content.
| sub-processor | what it does for the Service | location |
|---|---|---|
| Cloudflare, Inc. | application hosting (Workers), database (D1), file storage (R2), the connections sandboxes and servers keep to us, the login form's bot check (Turnstile), DNS | United States; data centres worldwide, including the EU |
| Amazon Web Services, Inc. | the machines Cloud Sandboxes run on (Linux, Windows and macOS), in the region the organization chose | United States; machines in Germany (Frankfurt), the United States (N. Virginia) and India (Mumbai) |
| Runpod, Inc. (a Delaware corporation; 329 Bryant St #4D, San Francisco, CA 94107) | the GPU machines GPU sandboxes run on, in the region the organization chose; a GPU volume's files when the organization keeps one | United States; machines in data centres in Europe (Romania, Iceland, Sweden) and North America (United States, Canada) |
| Fly.io, Inc. | the relay that forwards a member's ChatGPT/Codex subscription requests to OpenAI from an address that is not Cloudflare's. Data: the request in transit (including the member's ChatGPT sign-in token); nothing is stored | United States; the relay runs in Germany (Frankfurt) |
| Stripe, Inc. | payments, invoices, receipts | United States, Ireland |
| Resend, Inc. | transactional email (login codes, invitations, receipts, alerts) | United States |
| Loops.so, Inc. | product and onboarding email. Data: email address, first name, account and plan attributes, product-usage events | United States |
| Functional Software, Inc. (Sentry) | error and crash reports from the website, the Service, the apps (iPhone/iPad, Mac, Android, Windows, Linux), the isolation command and the software that runs sandboxes and servers. Data: the error, where in our code it happened, the software version, the operating system and device model; addresses, tokens, sign-in codes, request bodies, environment values and the text of terminals, agents and chats are removed before a report leaves | United States |
| TypeSafe | the interpreter that turns a typed sentence into a command | to confirm |
| Groq, Inc. | transcription of push-to-talk audio | United States |
| GitHub, Inc. | when connected: sign-in avatar, repository access for sandboxes | United States |
| Slack Technologies, LLC | when installed: the Slack app's messages and events | United States |
| Microsoft Corporation | when installed: the Teams app's messages and events | United States, EU |
Not sub-processors, because you contract with them directly: the AI providers whose credentials you give your agents (Anthropic, OpenAI, and others), and the machines you connect as servers.