Sub-processors
Version 0.1, effective 22 Oct 2026.
Services that can receive personal information when you use this website or an Anaphase product. Each product's privacy notice says which of these it uses. "In use" means the product sends data there today; "planned" means only once the named feature is switched on.
| Provider | What for | Products | Data it can receive | Location | Status |
|---|---|---|---|---|---|
| Vercel Inc. | Hosting of this website, the web apps and their API routes | Website, BioPlot, SideScatter, BioSmith | Request logs (network address, time, path), API request bodies in transit | United States and edge locations worldwide | In use |
| Hetzner Online GmbH | Virtual server: MCP relay, sync server, BioGlyph | BioPlot (connector relay), BioSmith (sync server), BioGlyph | Account records, cloud saves, request logs | Nuremberg, Germany | In use |
| Supabase Inc. | Database for BioPlot cloud share links | BioPlot | Shared project content you choose to share | Region to be confirmed | In use |
| Anthropic PBC | Hosted AI assistant | All four, once hosted AI is funded | Prompts and the bounded context you confirm | United States | Planned |
| OpenRouter Inc. | Limited hosted AI on free models; routes to further model providers that it names per request | SideScatter | Prompts and the bounded context you confirm | United States, plus the routed provider | In use (limited mode) |
| Stripe Payments UK Ltd and Stripe Inc. | Payments and invoices | All, once paid plans exist | Name, email, billing details | UK, United States | Planned |
| Namecheap Inc. | Domain names, DNS and email forwarding | All | DNS queries; forwarded email | United States | In use |
| Transactional email provider (not chosen) | Account and sign-in email | BioSmith sync server, BioGlyph | Email address, message content | To be decided | Planned |
With your own AI key, the provider you choose (for example Anthropic, OpenAI or OpenRouter) is your provider, not Anaphase's sub-processor, and your agreement with it applies. The same is true of storage you connect yourself (Dropbox, Google Drive, OneDrive, S3) and of NCBI services you query from BioSmith.
Changes: Anaphase will update this list and its version before a new sub-processor receives personal information. Institutional customers with a data processing agreement will get 30 days' notice.
Contact: paul@anaphasescience.com.