Sub-processors

The vendors behind the Service.

Version 1.0 · Effective May 15, 2026

Cruma uses a small, deliberate set of third-party services to operate. We list categories of sub-processors plus the named AI providers who see your prompts. Active customers can request the current full list of specific named vendors in each category from privacy@cruma.ai.

Why we don't publish the full vendor list publicly. During private beta we may swap commodity vendors as we tune cost and quality. Naming every vendor publicly creates an unhelpful moving target and reveals stack details that don't materially affect your data-protection posture. Active customers (subject to a confidentiality obligation) get the full list on request and at least 30 days' notice of changes.

AI providers (named)

These third parties may process prompts, intermediate reasoning, and outputs in order to operate Cruma's AI features. None train on your data.

Vendor	Purpose	Region
Anthropic, PBC	Primary LLM inference (Claude)	USA
OpenRouter	LLM gateway / fallback routing	USA
OpenAI	LLM inference (fallback / specific tasks)	USA
Google AI Studio	LLM inference (long-context tasks)	USA

Other sub-processor categories

Category	Purpose	Region
Cloud hosting	Application + database hosting	USA
Managed database	Postgres + pgvector with row-level security	USA
Static site hosting	Marketing site + edge delivery	USA / global
Email send infrastructure	Deliverability, warmup, reputation monitoring	USA / EU
Object storage	Encrypted file storage for artifacts	USA
Payments processing	Subscriptions (post-launch)	USA
Product analytics	Privacy-respecting telemetry (no ad-tracking)	USA / EU
Error tracking	Application error monitoring	USA
LinkedIn signal broker	Public-data signals via licensed broker (no direct LinkedIn access from Cruma)	EU
Email find/verify	Commodity contact resolution for the waterfall	USA / EU
Customer support	Helpdesk / ticketing (post-launch)	USA

How to get the full named list

Active customers can request the current named-vendor list in each category — and subscribe to receive notification of changes — by emailing privacy@cruma.ai with the subject "Sub-processor list request." The list is shared under the confidentiality terms of your subscription.

Changes

We give at least 30 days' notice before adding or replacing a Sub-processor that processes Customer Personal Data, by email to workspace owners and by posting an updated version on this page. Customers who object on data-protection grounds can raise the objection per the DPA §7.

Contact

Questions: privacy@cruma.ai
Legal: legal@cruma.ai