Sub-processors

Tenux LLC uses a small set of third-party sub-processors to operate the Service. Each receives only the minimum data needed for its function. Consistent with our “we are the pipe” posture, we do not give them your source code, file contents, terminal output or Tenux Chat history to keep, except in three cases, each described in its entry below:

when you use Tenux-provided AI, Anthropic receives the prompt and the tool output the agent needs, which can include file contents, terminal output and earlier messages in the chat;
when you rent a cloud VM, what you store on it lives on a volume hosted by Fly.io;
when a connected AI assistant answers a decision by voice, the emailed receipt carries that decision’s text (Resend).

Your remote-access traffic also passes, in transit, through our relay (hosted on Fly.io) and the network providers listed below; we do not store it. This page lists every sub-processor we use; we update it whenever the list changes.

To be notified before a new sub-processor begins processing your data, email [email protected]. We give 30 days’ notice so you have a chance to object.

Current sub-processors

Supabase

Purpose: authentication (email, one-time codes, passkeys) and our lean account / routing / billing-state database. Data shared: email, account identifiers, authentication state. Location: United States.

Stripe, Inc.

Purpose: payment processing and subscription management — our financial system of record. Data shared: name, email, billing and payment details. Card data goes to Stripe and never to Tenux. Location: United States.

PostHog Inc.

Purpose: product analytics. Data shared: pseudonymous usage events (no personal content), coarse IP. Optional session replay runs only on our billing and account pages — never the workspace. Location: United States.

Functional Software, Inc. (Sentry)

Purpose: error and performance monitoring. Data shared: account identifier, IP address, and diagnostic stack traces. No code, terminal, or chat content is sent. Location: United States.

Fly.io, Inc.

Purpose: hosting for the managed relay and the cloud VMs you rent. Data shared: routing / connection metadata, IP, and — for a cloud VM — the data you store on its volume. Location: United States.

Cloudflare, Inc.

Purpose: DNS, edge networking / CDN, DDoS protection, and the tunnel layer that fronts your workspaces. Data shared: network / routing metadata, IP. Location: United States.

Vercel Inc.

Purpose: hosting for the Tenux web application. Data shared: request metadata, IP. Location: United States.

Resend (Plus Five Five, Inc.)

Purpose: transactional email — verification, receipts, billing and security notices. Data shared: email address, message content. For a voice-decision receipt from the Claude connector, the message content includes the decision’s question, the option picked and the reason Claude gave; we do not store that text ourselves, and Resend keeps sent messages under its own retention terms. Location: United States.

Upstash, Inc.

Purpose: managed Redis for short-lived operational state — sign-up verification codes and links, sign-in challenges, rate-limit counters, and Claude-connector connection checks. Data shared: email address (for a pending sign-up, for at most 15 minutes), hashed one-time codes and sign-up links, account and device identifiers, rate-limit counters (IP-derived, or keyed on a hash of your email). Entries are short-lived and expire automatically. Location: United States.

Axiom, Inc.

Purpose: application log storage and search, used to debug failures and investigate abuse. Data shared: request metadata, account identifier, IP address, and error diagnostics. No code, file, terminal, or chat content is sent. Location: United States.

Google LLC

Purpose: a public STUN server used during peer-to-peer connection setup, and email hosting for our support and privacy-request inboxes (Google Workspace). Data shared: your device’s public IP address (STUN), and the contents of any email you send to a tenux.dev address, such as [email protected] or [email protected]. No workspace, file, terminal, or chat content passes through Google. Location: United States.

Anthropic, PBC

Purpose: AI inference for the Tenux Chat agent. Data shared: the prompt and tool context the agent needs to respond. This applies only when you use Tenux-provided AI (the credit-funded path) — that path runs on Anthropic and on no other provider, which is why Anthropic is the one AI sub-processor listed here. Anthropic does not train on data submitted through its API. Location: United States.

If you use your own API key, set on your computer with tenux ai keys, none of the above applies to that traffic. Your prompts go from your computer directly to the provider that issued the key, under your own agreement with them. That provider is not a Tenux sub-processor, and Tenux’s servers don’t store the key. Some supported providers process data outside the United States; tenux ai keys set shows where when you add a key.

If you connect Claude to your computer (the Claude connector), what Claude reads there goes to Anthropic under your own Claude account, at your direction. For that traffic Anthropic is not a Tenux sub-processor, and the API statement above about training does not apply: your agreement with Anthropic and your Claude settings govern it. See Services you connect in our Privacy Policy.

Questions

Questions about this list: [email protected]. See also our Privacy Policy.