BOXCOMPUTE TRUST
Subprocessors
The companies that process customer data to run the hosted BoxCompute service. Updated November 7, 2026.
Infrastructure
| Subprocessor | What it does | Data it receives | Location |
|---|---|---|---|
| Colocation data centre | Houses BoxCompute's servers: your VMs and the app's database. | Everything stored in the service | Cyberjaya, Malaysia |
| Amazon Web Services | S3 storage for files you upload and off-site database backups; Key Management Service for the keys that seal stored secrets. | Uploaded files, database backups, wrapped encryption keys | Malaysia (ap-southeast-5) |
| Cloudflare | DNS, TLS and network edge for the website, app, API and preview links; Turnstile bot protection at sign-up; website hosting. | Web traffic to BoxCompute, IP addresses, browser signals at sign-up | Global network |
| Tailscale | Encrypted network between our servers, with a relay for some connections. It carries only encrypted traffic it cannot read. | Encrypted network traffic | Relay in Singapore |
AI models
A chat's prompts go only to the provider behind the model it uses. Models that run on your own key or your own server send prompts to that provider under your agreement with it, not ours.
| Subprocessor | What it does | Data it receives | Location |
|---|---|---|---|
| Anthropic | Claude models (Haiku, Sonnet, Opus) for chats and agents that use them. | Prompts, conversation history, files and tool results in those chats | United States |
| OpenRouter | Routes DeepSeek V4.1 Flash requests to Together AI or Fireworks AI, and only those hosts, with zero data retention and data collection turned off. Flash is a chat model, describes images for models that cannot see, and summarises long chats. | Prompts, conversation history and images sent to DeepSeek V4.1 Flash | United States |
| Together AI | Hosts DeepSeek V4.1 Flash, through OpenRouter or directly. | As for OpenRouter | United States |
| Fireworks AI | Hosts DeepSeek V4.1 Flash, through OpenRouter. | As for OpenRouter | Global |
| Meta | Muse Wonder, for organization accounts that choose it. | Prompts and conversation history in those chats | United States |
| BytePlus | DeepSeek, GLM and Seed models on ModelArk, only for accounts given BytePlus models. | Prompts and conversation history in those chats | Southeast Asia |
Payments, email and notifications
| Subprocessor | What it does | Data it receives | Location |
|---|---|---|---|
| Stripe | Payments, top-ups and the Starter subscription. | Account email; card details you enter on Stripe | Global |
| Resend | Sign-in, invitation and account emails, and emails your agent sends you. | Your email address and the email content | United States |
| Slack | Our team's internal notifications about sign-ups, payments and incidents. | Account email addresses and event details | United States |
Services you connect
When you connect GitHub, Google, your own model provider, your own MCP servers or an app such as Claude through our MCP server, information goes to that service because you asked for it, under its own terms. They are not our subprocessors.
Changes
We update this page when we add or replace a subprocessor. For questions, email [email protected].