Data residency
Each workspace's evidence bucket is provisioned in a dedicated EU or US region and stays there for the lifetime of the workspace; for a bucket in the customer's own cloud, the customer chooses and controls that region. The managed application database — accounts, membership and roles, workspace settings, hashed API keys, approval state, grant-limit counters and the limited decision index — is EU-hosted. We state the two separately so that "evidence in a US region" is never read as a claim that account and control records moved there.
Agent Control Room is a policy decision point, not an AI model provider: it evaluates proposed actions against your rules and does not send decision data to a model of ours. A workspace may separately pair the supported Complyee Policy Library integration as described below.
Optional Complyee pairing
Complyee is an optional, customer-configured companion service, not part of the default Agent Control Room service and not an interchangeable policy-library endpoint. The customer supplies its Complyee gateway and API key and must have its own appropriate arrangement with Complyee. On that basis, Complyee is the customer's provider rather than our sub-processor, so it is not included in the table above.
When consultation is enabled for an action, Agent Control Room sends Complyee the action key, a plain-language action description of up to 2,000 characters, the agent key, a decision correlation identifier and up to 40 supplied context facts. Extra context fields may be forwarded. It does not send the payload hash or the underlying document, prompt, message or other payload. Complyee returns a structured assessment that Agent Control Room records with the decision; the reading may advise or restrict according to the customer's settings, but cannot grant authority.
Bring your own cloud
A workspace can hold its evidence in its own cloud storage bucket (Google Cloud Storage today): your bucket, your region, your access. For those workspaces Google is your own provider rather than our sub-processor, and the Google row above does not apply to your rule sets, decision evidence or audit trail — Agent Control Room holds only a scoped credential that you issue and can revoke.
Payments
Paid plans are sold through Paddle, which acts as Merchant of Record. Paddle independently processes the payment, billing, sales tax and VAT, invoicing, refunds and chargebacks, and its own privacy notice applies to that processing (paddle.com/legal/privacy).
Card details are entered in Paddle's own checkout and never reach Agent Control Room; we receive only order metadata such as plan, transaction identifier and billing country. Paddle's checkout script runs only on checkout and billing pages, and never on pages where policies, decisions or approvals are handled.
Supporting vendors (no customer data)
We also use tools that never touch customer policy data or member data, and which we therefore do not list as sub-processors: source code hosting, the development and deployment platform, our domain registrar and DNS, and internal productivity tooling. If your review needs these named individually, we will list them for you.
Changes to this list
This page carries the date it was last updated, and it is the authoritative version. We have not yet committed to a fixed advance-notice period for new sub-processors; where a notice window matters to you, it belongs in the data processing agreement and we are happy to agree one.
To be told when this list changes, or to ask about a specific provider, write to security@complyee.ai.