Last reviewed: 2026-06-22. This date is refreshed on each material change to the list below.
Current subprocessors
The table below lists every third party with which AgentMessage shares Customer Data in order to operate the Service. The data column describes the categories sent to each vendor; for the full picture of what AgentMessage collects and why, see the Privacy Policy.
| Subprocessor | Purpose | Data processed | Location | Reference |
|---|---|---|---|---|
| DigitalOcean | Cloud hosting, compute, database, storage, networking, and infrastructure for the Service. | Account data, organization data, message data, routing metadata, consent records, logs, API data. | United States; cloud infrastructure regions. | digitalocean.com/legal/privacy-policy |
| Bandwidth | Upstream messaging origination and termination, number provisioning, carrier routing, telecom services, delivery records, and carrier compliance. | Phone numbers, message content, message metadata, delivery records, number data, and campaign or customer data as required for routing and registration. | United States. | bandwidth.com/legal/privacy-notice |
| The Campaign Registry (TCR) | 10DLC brand and campaign registration, vetting, and carrier compliance workflows. | Business identity, brand information, campaign and use-case details, sample messages, consent-flow information, and related registration data. | United States. | campaignregistry.com/privacy-policy |
| Stripe AgentMessage does not store payment card numbers or bank account details. Those are held directly by Stripe under their own terms. | Billing and payments for prepaid wallet top-ups and optional recurring auto-topup, plus tax handling. | Billing email, payment instruments you provide (handled directly by Stripe), Stripe customer identifier, wallet top-up and auto-topup state, invoice line items. | United States; Stripe operates globally with EU presence. | stripe.com/privacy |
| Clerk | User authentication, session management, and organization-membership state. | Email, first and last name, profile image URL, Clerk-issued user identifier, organization-membership data, role. | United States. | clerk.com/privacy |
| Anthropic AgentMessage does not intentionally submit recipient phone numbers for AI review, but message bodies may contain personal information included by customers or recipients. Where available for the applicable provider, product, and account configuration, AgentMessage configures Anthropic to minimize retention and disable training. AgentMessage does not authorize Anthropic to train on Customer Data. | Large-language-model inference for AI-assisted abuse detection, compliance review, message classification, account-risk review, and policy enforcement. | Flagged message content, account or organization context, compliance-review metadata, support context as needed. | United States; provider may use global infrastructure. | anthropic.com/legal/privacy |
| OpenAI AgentMessage does not intentionally submit recipient phone numbers for AI review, but message bodies may contain personal information included by customers or recipients. Where available for the applicable provider, product, and account configuration, AgentMessage configures OpenAI to minimize retention and disable training. AgentMessage does not authorize OpenAI to train on Customer Data. | Large-language-model inference used alongside or in place of Anthropic for the same AI-assisted compliance and abuse review features. | Same scope as Anthropic. | United States; provider may use global infrastructure. | openai.com/policies/privacy-policy |
| Vercel | Web hosting and CDN for the marketing site and customer dashboard. Edge middleware for routing. | HTTP request metadata: IP address, user agent, request path, response status, timing. No long-lived customer message content. | United States; Vercel operates globally. | vercel.com/legal/privacy-policy |
| Google Analytics 4 Configured in measurement-only mode. Google Signals is disabled, advertising-audience export is disabled, and there is no cross-site identity stitching or remarketing. Google acts as our analytics service provider under Google's Data Processing Terms. | First-party site analytics for the marketing site (agentmessage.io). Measurement only. Used to understand aggregated traffic patterns: page views, sessions, country and region, device type, referrer source. | GA4 first-party cookies (_ga, _ga_*), IP address, user agent, page URL, referrer, and other standard GA4 measurement signals. No customer dashboard or product traffic. | United States; Google operates globally. | policies.google.com/privacy |
A note on AI providers
Anthropic and OpenAI are listed above because AgentMessage may send account data and message content to either provider for AI-assisted compliance and abuse review (see the Privacy Policy). AI review is part of how AgentMessage operates the Service rather than an optional analytics feature. AgentMessage does not intentionally submit recipient phone numbers for AI review, but message bodies may contain personal information included by customers or recipients.
Where available for the applicable provider, product, and account configuration, AgentMessage configures AI providers to minimize retention and disable training. AgentMessage does not authorize AI providers to train on Customer Data. Because abuse and compliance review is part of the Service, customers cannot disable all AI-related Subprocessors or all compliance-related processing. Customers who require strict data-flow controls beyond those offered by the Service should reach out before using the Service to discuss whether AgentMessage is a fit.
What is not on this list
The following are deliberately excluded so the list stays focused on entities that process Customer Data on AgentMessage's behalf:
- Internal tooling vendors that do not access Customer Data (developer environments, code-hosting providers, internal analytics on aggregated metrics).
- Y3 Labs LLC employees and contractors, who handle Customer Data under our own internal access controls rather than as third parties.
- Customers' own webhook receivers. AgentMessage delivers messages and events to URLs you configure; those endpoints are operated by you, not by us, and are not Subprocessors.
Changes to this list
When we add a new Subprocessor, we will provide notice by updating this page and emailing the billing contact on file. We do not commit to a fixed advance-notice window. Operating in startup mode, we may onboard new Subprocessors quickly when the business or security posture requires it.
Customers may object to a new Subprocessor by contacting privacy@agentmessage.io. If we cannot accommodate the objection without removing the affected feature, we will work with you on either a feature-level opt-out or termination of the affected service in accordance with the Data Processing Addendum.
Changelog
Material additions and removals are summarized below for the prior 24 months.
- 2026-06-22 (v1.1): corrected the Stripe entry to describe prepaid wallet top-ups and optional recurring auto-topup. Subscription billing has been retired.
- v1.0 baseline.
Contact
For questions about a Subprocessor, to object to a change, or to request the underlying data-processing agreements, contact privacy@agentmessage.io.
Y3 Labs LLC845 Houston Northcutt Blvd #1079
Mt Pleasant, SC 29464
United States
Attn: Legal
legal@agentmessage.io