Subprocessors

JestBot uses a small, deliberately limited number of third-party providers to run the platform. Some process data for every customer by necessity — hosting, payments, authentication; others, specifically the BYOK model providers, only ever see your data if you personally choose to configure that provider’s API key on a bot. If you stick with the default Ollama-backed model, none of the BYOK providers listed below receive any of your data, since Ollama runs on our own self-hosted infrastructure rather than calling out to a third party.

A subprocessor is any third party we engage that processes personal data on our behalf in order to deliver JestBot to you. This is distinct from a service you connect yourself for your own purposes outside JestBot’s core function — we’re listing providers that are structurally part of how JestBot itself operates.

This is the foundational layer — every account, bot, document, embedding, and conversation record is stored here. See our Security page for how this data is encrypted and access-controlled.

JestBot does not directly store your full card number or payment credentials — those are handled entirely within Razorpay’s PCI-compliant systems. We store only the billing metadata needed to manage your subscription (plan, status, renewal date, transaction history).

These providers only ever process data for bots where you’ve explicitly added that provider’s API key yourself. Each request made through your key is subject to that provider’s own data handling, retention, and training-use terms — JestBot passes your message content to them at query time but does not control what that provider does with it afterward, so we’d encourage reviewing each provider’s own policy if this matters for your use case.

Before adding a new subprocessor, we consider its own security practices, data handling terms, and whether it's necessary for a feature we're building, rather than adding third parties by default. We aim to keep this list as short as practically possible.

[Placeholder — state the actual regions/data centers used by your hosting provider here, e.g. "Primary data storage is located in [region]." This matters for customers with data-residency requirements and should reflect your real infrastructure setup, not be left generic.]

We’ll update this page whenever we add or remove a subprocessor. For material changes affecting how your data is processed — for example, adding a new BYOK provider or changing hosting infrastructure — we’ll also notify account holders directly by email where required by applicable law, giving you the opportunity to object before the change takes effect where such a right applies under your agreement with us.

If your organization requires a signed Data Processing Agreement referencing this subprocessor list, or has additional vendor security questionnaire requirements, reach out via the contact page.