Supabase
Purpose: managed authentication, PostgreSQL database, row-level security, server/client data APIs, and Knowledge Base file storage.
Processing: AGENEON user accounts and sessions; workspace, agent, catalog, knowledge, customer, conversation, channel, handoff, and integration records; encrypted Google Calendar credential payloads; and uploaded TXT files. Region and residency depend on the selected Supabase project configuration.
OpenAI
Purpose: generate AI-agent responses and create embeddings for Knowledge Base retrieval.
Processing: bounded instructions, relevant business context, catalog/knowledge excerpts, user messages and limited conversation history for responses; text chunks or search queries for embeddings. Responses API requests set store to false in the implementation. Processing location and retention are governed by the active OpenAI service configuration and terms.
Google APIs / Google Cloud
Purpose: user-authorized Google authentication as configured through Supabase and the separate Google Calendar connection.
Processing: OAuth authorization and token exchange; calendar-list discovery; free/busy requests for approved calendars; optional creation of events on approved calendars owned by the authorizing user; and token revocation. Google Calendar data is processed only when a user connects and authorizes the integration.
Not currently listed
GitHub is used for source-code collaboration but is not evidenced as processing production customer data, so it is not listed as a customer-data subprocessor. Meta, WhatsApp, Instagram, Facebook, Shopify, WooCommerce, HubSpot, and custom APIs are future architecture entries or coming-soon surfaces and are not active subprocessors based on the current code.
The production web hosting provider is not provable from repository configuration and must be added after owner confirmation. This page does not guess regions, data-residency commitments, certifications, or contract terms.
Changes to this list
AGENEON will update this page before a new provider begins materially processing customer data where practical. Customers should review this page periodically. A formal subprocessor-notice process and dedicated contact await owner confirmation.