Effective: May 1, 2026
Subprocessors
These are the third-party services dusto uses to operate. We add a provider only when we need it. Material changes are posted here and (where they affect you) emailed to account holders.
§01CURRENT PROVIDERS
Who processes what.
| Provider | Purpose | Data they receive | Region |
|---|---|---|---|
| AWS (Lambda, DynamoDB, S3, SES, Cognito, SQS, EventBridge, KMS, CloudWatch, API Gateway, CloudFront, Route 53) | Compute, storage, email send/receive, auth, queueing, CDN, DNS, encryption | All operational data including account records, parsed email content, agent traces, billing ledger | us-east-1 (CloudFront global) |
| OpenAI | LLM that powers the orchestrator, drafters, and agent planner | Email content (inbound), agent prompts | US (provider default) |
| AWS Bedrock (Amazon Nova Lite) | LLM for the per-inbound urgency classifier | Subject, bounded body excerpt, triage headers | us-east-1 |
| Stripe | Payments, subscription, invoicing | Email, name (if provided), card data (Stripe-only — we never see card data), payment metadata | Global |
| OAuth identity provider (only if you sign in with Google) | Email, name, profile picture (per OAuth scopes) | Global |
Some of these are processors acting on our instructions (AWS); some are independent controllers for the data they receive (Stripe for payments, Google for sign-in, OpenAI and AWS Bedrock for LLM inference under their API terms). We're working toward formal Data Processing Addenda with each. A DPA with us is available on request for business customers — email admin@spicadust.com.