Alter — Sub-processor list
Last updated: 2026-09-15 (draft)
Third parties that process customer data on alter's behalf:
| Sub-processor | Purpose | Data touched | Region | Retention / training posture |
|---|---|---|---|---|
| Anthropic PBC | AI processing (recognition, compilation, responses) | Capture-derived text | US | No training on API data (published policy); ~30-day standard API retention; enterprise zero-retention planned before public GA |
| OpenAI LLC | AI processing (fallback provider) | Capture-derived text | US | Same posture as Anthropic |
| Perplexity AI, Inc. | Explore-mode web search (Sonar API) | Research queries derived from captures | US | Published zero-data-retention + no-training Sonar API policy (policy-based, not contractual) |
| Stripe, Inc. | Payments, subscriptions, invoicing | Email, billing details, payment method (Stripe-held) | US/EU | Independent controller for payment records (legal retention obligations) |
| Hetzner Online GmbH | Infrastructure hosting | All service data (encrypted at rest) | Germany (EU) | Hosting only |
| Cloudflare, Inc. (R2) | Encrypted database backups + object storage | Encrypted archives, uploaded files | EU jurisdiction | 30-day rolling backup retention |
| Functional Software, Inc. (Sentry) | Error monitoring | Error reports (content-scrubbed before send) | EU (Sentry EU region) | Content keys stripped client-side by privacy scrubber |
| Resend, Inc. | Transactional email (verification, password reset) and the opt-in daily briefing email | Email address; with the daily email on, that day’s briefing text (verdict line, lanes, picks) | US | Delivery only — no tracking pixels or link tokens in alter’s mail; delivery logs per Resend’s retention policy |
Sign-in with Google (Google Ireland Ltd.) acts as an identity provider when you choose it — we receive your email and Google account identifier; no alter content flows to Google.
Changes to this list are announced to account holders before new sub-processors receive customer data.