This register describes providers and services used for hosting, delivery, retained data, and customer-selected AI requests. AWS hosting and CloudFront delivery are services of the same vendor. Contractual subprocessor roles and notice obligations follow your signed DPA. Effective October 12, 2026.
A subprocessor is an outside company we use to provide part of Cuttlefish — for example, the servers that run it or the network that delivers it. We keep this list current and give advance notice before a new or replacing subprocessor starts handling customer data, so you have a chance to review or object.
| Provider / service | Purpose | Data categories | Processing region | Entity / jurisdiction |
|---|---|---|---|---|
| Amazon Web Services (AWS) | Current hosting and infrastructure — the servers, database, and file storage that run the Cuttlefish hosted services and hold the website files. | Account and organization data; conversation history and memories saved to your account; encrypted cloud provider keys; governance records; usage and diagnostic logs. | United States (US East region). | Amazon Web Services, Inc. (United States). |
| Amazon Web Services — CloudFront delivery | Delivery and edge network for getcuttlefish.app and app.getcuttlefish.app — serves pages quickly and helps keep them available. | Network request metadata such as IP address, browser type, and the pages requested. | Global edge network, served from the location nearest you. | Amazon Web Services, Inc. (United States). |
| Microsoft Azure | Retained storage and backups from our former hosting of the Cuttlefish service. That former system is disabled and no longer runs the service, but its stored data and backups are still retained and have not been erased. | Data held by the former service while it ran, which can include account and organization data, conversation history and other stored content, encrypted cloud provider keys, and logs. | United States. | Microsoft Corporation (United States). |
| Customer-selected AI providers | Running your request through the AI model you connect — for example a cloud model from a provider you choose. This applies only when you send a request to a cloud model. Requests to a model running on your own machine are processed there and are not sent to any AI provider. | The request, selected context, and response, which can include authorized file excerpts, images, or tool results. | Varies by the provider you connect. | Varies by the provider you connect. |
Cuttlefish Founders purchasing is arranged with our team. No payment processor currently handles customer data for Cuttlefish. Before one does, we will add it to this register and give notice.
You choose your model, and each company on this list handles only the data it needs for the part of Cuttlefish it provides.
When you run a model on your own machine, your prompts and its answers are processed there and no AI provider receives them. The conversation is still saved to your Cuttlefish account in our hosted services, as the Privacy Policy explains.
The delivery network sees request metadata, the hosting provider stores what your account holds, and an AI provider receives only the requests you send to its models.
Before a new company starts handling customer data, or one is replaced, we update this register and give notice so you can review the change and raise an objection if you have one.
For a countersigned subprocessor list or contractual data-processing terms, request the packet and we'll route it through legal review.
