Cartograph uses the providers below to process Customer Personal Data on its behalf. The exact providers involved depend on the features, integrations, and model routes a customer uses.
“Provider locations” means the locations documented by the provider and permitted under Cartograph’s agreement and transfer safeguards.
Text model inference is routed through Vercel AI Gateway. Live voice sessions connect to OpenAI through LiveKit. These routes use providers that do not use prompt data to train their models. The providers listed below are the ones reachable under that control for the models Cartograph runs.
1. Core service providers
| Provider | Purpose | Customer data | Processing region |
|---|---|---|---|
| Vercel, Inc. | Application hosting, functions, storage, AI routing, and runtime infrastructure | Requests, files, logs, and AI inputs as required by the feature | United States and provider locations |
| Neon, Inc. | Managed PostgreSQL databases | Workspace records and Customer Content | United States |
| WorkOS, Inc. | Authentication, organization directory, and secrets vault | User identity, organization metadata, and integration secrets | United States |
| Upstash, Inc. | Transient chat streams and collaboration presence | In-flight chat content and presence metadata | United States and provider locations |
| Doppler, Inc. | Application secrets management | Application secrets; not intended for Customer Content | United States |
2. Communications and support
| Provider | Purpose | Customer data | Processing region |
|---|---|---|---|
| Telnyx LLC | Phone numbers, calling, and messaging | Phone numbers, call and message routing, and SMS content | United States and provider locations |
| LiveKit, Inc. | SIP and real-time voice infrastructure | Live call audio, phone numbers, and voice-session metadata | United States and provider locations |
| Resend, Inc. | Email delivery and receipt | Email addresses, message content, and attachments | United States |
| Knock Labs, Inc. | In-product and mobile push notifications | Recipient identifiers, device push tokens, and notification payloads | United States |
| Apple Inc. | Push notification delivery to iOS devices (via our notification provider) | Device push tokens and notification content | United States and provider locations |
| Intercom, Inc. | Customer support and in-product messenger | User identity and support conversation content | United States and provider locations |
3. AI, document, analytics, and integration providers
| Provider | Purpose | Customer data | Processing region |
|---|---|---|---|
| Alibaba Cloud | AI model inference through Vercel AI Gateway | Prompts and context selected by the enabled feature | United States and provider locations |
| Baseten | AI model inference through Vercel AI Gateway | Prompts and context selected by the enabled feature | United States and provider locations |
| DeepInfra | AI model inference through Vercel AI Gateway | Prompts and context selected by the enabled feature | United States and provider locations |
| Fireworks AI | AI model inference through Vercel AI Gateway | Prompts and context selected by the enabled feature | United States and provider locations |
| Microsoft Azure | AI model inference and embeddings through Vercel AI Gateway | Prompts, context, and text selected by the enabled feature | United States and provider locations |
| Novita AI | AI model inference through Vercel AI Gateway | Prompts and context selected by the enabled feature | United States and provider locations |
| OpenAI | AI model inference and embeddings through Vercel AI Gateway; live voice inference and delegated reasoning through LiveKit | Prompts, context, text, live call audio, and transcripts selected by the enabled feature, including email content where the Customer has connected a mailbox | United States and provider locations |
| Together AI | AI model inference through Vercel AI Gateway | Prompts and context selected by the enabled feature | United States and provider locations |
| xAI | AI model inference through Vercel AI Gateway | Prompts and context selected by the enabled feature | United States and provider locations |
| ElevenLabs | Real-time speech transcription through LiveKit | Live call audio and voice-session context | United States and provider locations |
| Reducto AI, Inc. | Document extraction and parsing | Documents selected for processing | United States |
| PostHog, Inc. | Product analytics, error tracking, and configured AI operational telemetry | Product events, masked replay, diagnostics, and limited operational metadata | United States |
| Google LLC | Google Maps address enrichment | Business address queries and returned geocoding results | United States and provider locations |
| Conductor LLC | QuickBooks Desktop connectivity | Authorized accounting records and connector user identity | United States |
| Microsoft Corporation | Customer-connected Microsoft 365 mailboxes | Mailbox content, attachments, identities, and authorization data selected by Customer | Customer tenant and Microsoft locations |
| Google LLC | Customer-connected Gmail mailboxes | Mailbox content, attachments, identities, and authorization data selected by Customer | Customer account and Google locations |
Cartograph selects among the listed providers based on the enabled feature, customer configuration, region, availability, and security requirements. AI providers receive the inputs and context needed for the requested feature.
4. Billing providers
| Provider | Purpose | Customer data | Processing region |
|---|---|---|---|
| Stripe, Inc. | Payments and billing | Billing contacts, payment tokens, transaction and fraud information | United States and provider locations |
| Metronome, Inc. | Usage measurement, rating, and invoicing | Customer identifier, plan, and usage events; no intended message content | United States |
5. Changes and objections
Cartograph will provide at least 30 days’ notice before a new subprocessor begins materially different processing of Customer Personal Data. Customer may object during that period on reasonable data-protection grounds by emailing hello@cartograph.ai.
The parties will work in good faith on a commercially reasonable solution. If none is available, Customer may stop using or terminate the affected feature before the change takes effect, as described in the DPA.