Aluna uses the companies below to host, secure, authenticate, support, and provide AI and other features of the Services. Depending on the features a Customer uses, these companies may receive or process Customer data for us. The list explains what each company does and the kinds of data involved. Providers used only for the public marketing website are described in our website Privacy Policy.
This page is informational and does not replace a signed customer agreement, data processing addendum, or other applicable contractual terms. If this page conflicts with a signed agreement, the signed agreement controls. Our Services Privacy Policy explains how Aluna handles Customer data more generally.
For questions, current subprocessor information, or security questionnaires, contact security@getaluna.ai.
Companies we use
Google LLC / Google Cloud Platform
- Services used by Aluna: Google Cloud Spanner, Google Cloud Storage, Google Cloud KMS, Google Kubernetes Engine, Vertex AI, and paid Gemini API services where configured
- Purpose: Core cloud infrastructure, structured data storage, provider attachment cache, key-managed encryption operations, and AI model processing
- Customer data that may be processed: Account, policy, workflow, document metadata, temporary provider-cache objects, prompts, documents, model inputs, and model outputs as needed to provide the product
- Processing location / notes: Core infrastructure is configured in United States regions, including us-central1. Google and its subprocessors may perform limited processing in other locations under the applicable service terms
- Reference: Google Cloud subprocessors, Gemini API terms
Cloudflare, Inc.
- Services used by Aluna: Cloudflare R2, Cloudflare Tunnel / Zero Trust Tunnel, DNS/proxy/edge services, Workers, Workers KV, Queues
- Purpose: Document and object storage, product-feedback storage, audit archive storage, public edge routing, protected application ingress, webhook routing, and event delivery
- Customer data that may be processed: Document/object bytes and metadata, feedback messages and evidence, audit archive entries, request metadata, webhook routing metadata, and webhook/event payloads
- Processing location / notes: Cloudflare edge, tunnel, and queue services use Cloudflare's global network. R2 storage location and jurisdiction follow the applicable bucket configuration and Cloudflare terms
- Reference: Cloudflare subprocessors, R2 data security, Cloudflare Tunnel
OpenAI OpCo, LLC and affiliates
- Services used by Aluna: OpenAI API Platform
- Purpose: AI model processing for supported Aluna workflows
- Customer data that may be processed: Prompts, structured context, documents or document excerpts, generated responses, and model outputs as needed to provide the product
- Processing location / notes: Processing locations and downstream providers are described in OpenAI's current subprocessor list and applicable business/API data processing terms
- Reference: OpenAI subprocessor list, OpenAI enterprise privacy
Amazon Web Services, Inc.
- Services used by Aluna: Amazon Bedrock
- Purpose: AI model processing for supported Aluna workflows
- Customer data that may be processed: Prompts, structured context, documents or document excerpts, generated responses, and model outputs as needed to provide the product
- Processing location / notes: Bedrock does not use customer content to train models or share it with third-party model providers; processing occurs in the AWS regions Aluna configures per environment
- Reference: AWS subprocessors, Bedrock data protection
Stytch, Inc. (a Twilio company)
- Services used by Aluna: Stytch B2B authentication and session services
- Purpose: User authentication, session management, organization membership, and machine-to-machine authentication
- Customer data that may be processed: User identifiers, email addresses, organization membership, session metadata, authentication events, and machine-to-machine client metadata
- Processing location / notes: Stytch remains the service provider for the Stytch platform. Its processing and downstream providers are described in Stytch and Twilio compliance materials
- Reference: Stytch compliance, Twilio subprocessors
Google LLC / Google Workspace
- Services used by Aluna: Google Workspace, including Gmail, Google Drive, Google Docs, and related collaboration tools
- Purpose: Business operations, document collaboration or delivery where applicable, support, and security review workflows
- Customer data that may be processed: Customer-provided files, support correspondence, security questionnaire materials, and shared documents where customers or Aluna use Workspace for those workflows
- Processing location / notes: Processing follows Google Workspace terms and Google Workspace subprocessor disclosures
- Reference: Google Workspace subprocessors
Salesforce, Inc.
- Services used by Aluna: Slack
- Purpose: Internal receipt and review of product feedback submitted in Aluna
- Customer data that may be processed: Sender and organization identity, feedback text, page address, timestamps, attached images, and browser errors when the sender explicitly includes them
- Processing location / notes: Processing and retention follow Aluna's Slack workspace configuration and Salesforce's applicable service terms
- Reference: Salesforce trust and compliance, Slack security
Notes
- When a Customer connects Aluna to Microsoft 365, Outlook, QuickBooks Online, a carrier portal, or another outside system, data may also be sent to that system at the Customer's direction. Those systems are not necessarily Aluna service providers.
- Self-operated components are not listed as third-party subprocessors. For example, Aluna runs NATS JetStream/KV and SpiceDB in its own cloud infrastructure rather than using those components as hosted third-party services.
- AI providers process data only as needed to provide the configured Aluna workflow. Aluna uses paid or business API offerings under terms that do not permit those providers to use Customer prompts, documents, or generated responses to train shared foundation models.
- A provider's own subprocessor list may include affiliates and downstream infrastructure, support, security, or moderation providers that the provider uses under its contract with Aluna.
Changes to this list
We update this page when our subprocessor practices change and provide any additional notice required by a Customer's agreement. Contact security@getaluna.ai with questions about a planned or current provider.