Legal
Sub-processors
Last updated: May 2026
This page lists the third-party Sub-processors that Allotly engages to provide the Service. Sub-processors are bound by written contracts imposing data protection obligations no less protective than those in our Data Processing Agreement.
We notify Customers of any intended additions or replacements of Sub-processors at least 30 days in advance, either via this page or by email to the account administrator. To receive change notifications, email security@allotly.ai with the subject line "Subprocessor notifications".
Current Sub-processors
| Sub-processor | Purpose | Location of processing |
|---|---|---|
| Replit, Inc. | Application hosting and compute (Replit Deployments, autoscale) | United States (Google Cloud, us-central1) |
| Neon Inc. (via Replit Database) | Managed PostgreSQL hosting (encryption at rest) | United States |
| Stripe, Inc. | Payment processing and subscription management | United States |
| Resend (Resend.com, Inc.) | Transactional email delivery (verification, invites, notifications) | United States |
Operational telemetry: Allotly does not currently engage a third-party error monitoring or application performance monitoring provider. Operational logs and crash data are retained within the hosting provider's platform.
Internal caching layer: Allotly uses an in-memory and Redis-compatible cache for short-lived rate-limit counters, concurrency tokens, and cached pricing metadata. Cache entries contain no Personal Data on their own.
AI providers
The following are not Sub-processors of Allotly. When a Customer's end-user sends a prompt through the Service, the prompt is forwarded to the AI provider selected by that end-user, under that provider's own terms and privacy policy. Allotly does not store the content of prompts or completions.
- OpenAI
- Anthropic
- Google (Gemini / Vertex AI)
- Microsoft Azure OpenAI Service
- Any additional providers enabled by the Customer's configuration.