Subprocessors
Last updated: May 29, 2026
Version: 2.0
Effective date: May 29, 2026
This page lists the subprocessors that skilder uses to deliver the Services. It is published in support of skilder's Privacy Policy and the Processing of Customer Personal Data clause of the Terms of Service.
How to be notified of changes
Subscribe to changes by emailing contact@skilder.ai with subject "Subscribe to subprocessor
updates". We notify subscribers at least 30 days in advance of a new or replacement
subprocessor processing Customer Personal Data, in line with §10.1 of the Terms of Service.
You may object to a change on reasonable data-protection grounds; if we cannot accommodate the objection, you may terminate the affected Services and receive a pro-rata refund of pre-paid unused fees.
A. Infrastructure subprocessors (control plane and storage)
| Subprocessor | Service | Country of processing | Transfer mechanism |
|---|---|---|---|
| Infomaniak Network SA | Primary hosting, virtual machines, managed Kubernetes, object storage | Switzerland | None required (Swiss-only) |
| Dgraph (self-managed) | Graph database, workspace, Skill, Hat, MCP, audit data | Switzerland | None required (Swiss-only) |
| NATS (self-managed) | Message bus for runtime orchestration | Switzerland | None required (Swiss-only) |
B. AI model providers (skilder-managed routing)
For skilder-managed routing, skilder currently routes inference exclusively through a single provider:
| Subprocessor | Models routed | Country of processing | Transfer mechanism | Training-on-content |
|---|---|---|---|---|
| Infomaniak Network SA | Infomaniak AI Tools (open-weight models offered through the Infomaniak AI Tools product) | Switzerland | None required (Swiss-only) | Contractually disabled |
Where a Customer connects its own API key ("BYOK") to a different provider (for example Anthropic, OpenAI, Mistral, Google), that provider is the Customer's subprocessor, not skilder's. See §6.3 of the Terms.
If skilder adds a further provider for skilder-managed routing in the future, it will be added to this list at least 30 days before it begins processing Customer Personal Data, and Customers will be notified via the subscription mechanism above.
C. Connector and integration providers
The only OAuth-connected integration that skilder operates as its own subprocessor is the Infomaniak suite. Any additional OAuth connection that a Customer chooses to set up from the workspace is configured by the Customer at its discretion; for those, the Customer is responsible for the third party's terms, the scopes granted, and the resulting data flows, and the third party is the Customer's subprocessor, not skilder's.
| Subprocessor | Service | Country of processing | Transfer mechanism |
|---|---|---|---|
| Infomaniak Network SA | kDrive, kMail, and other Infomaniak services connected via OAuth | Switzerland | None required (Swiss-only) |
| Customer-added OAuth integrations (e.g. Google Workspace, Microsoft 365, others) | Configured at the Customer's discretion from workspace settings | As applicable to the chosen provider | The Customer's responsibility, the third party is the Customer's subprocessor, not skilder's |
OAuth tokens issued by these providers are stored on the terms of §6.4.2 of the Privacy Policy.
D. Operational subprocessors
| Subprocessor | Service | Country of processing | Transfer mechanism |
|---|---|---|---|
| PostHog Inc. | Product analytics, EU Cloud (Frankfurt) | Germany (EU) | None required (intra-EEA); SCCs for any vendor support access from outside EEA |
| Google LLC (Gmail / Google Workspace) | Transactional and product email | United States / EU | SCCs + DPF (where certified) + Swiss Transfer Annex |
| Mollie B.V. | Subscription billing, invoicing, and payment processing (Europe) | Netherlands (EU) | None required (intra-EEA) |
| Linear Orbit, Inc. | Internal issue tracking; customer-reported issues and support exchanges may be recorded here | United States | SCCs + DPF (where certified) + Swiss Transfer Annex |
skilder does not currently use a dedicated error-tracking or customer-support tooling subprocessor; if one is added, it will appear on this list with the 30-day prior notice described above.
E. Professional advisers
External lawyers, auditors, and accountants are engaged from time to time under duties of confidentiality. Names are not published but are available on request to the extent they process personal data identifying you.
Out of scope
The following are not skilder subprocessors:
- BYOK invocations: the third-party AI provider you call with your own key is your subprocessor, not ours.
- Customer-added OAuth integrations (Section C, second row): the third party is your subprocessor, not ours.
- Self-hosted runtime (
@skilder/runtimedeployed on infrastructure you operate): processing carried out exclusively on that runtime in the data plane is yours (control-plane interactions with the skilder cloud workspace remain governed by the Privacy Policy and these Terms). - Third-party services you integrate via OAuth or APIs for your own purposes outside of a Skill: governed by your contract with that third party.
Change log
This log records additions, replacements, and removals of subprocessors. Each entry is the record of the 30-day prior notice given under §10.1 of the Terms of Service. The "Effective" date is the date from which the change applies; the "Notified" date is when notice was first published or sent to subscribers.
| Notified | Effective | Subprocessor | Category | Change |
|---|---|---|---|---|
| May 29, 2026 | May 29, 2026 | N/A | N/A | Initial publication of the subprocessor list (v2.0). |
No subprocessor changes are pending at the date of last update. When a change is planned, it is added here at least 30 days before it takes effect and announced to subscribers (see "How to be notified of changes" above).