Sub-processors
Last updated: May 2026
These are the third-party vendors with potential access to customer data on hosted Octopus. Self-hosted Octopus has none of these by default — your data stays within your own infrastructure unless you explicitly configure an integration that needs an external vendor (e.g. Slack notifications or a non-self-hosted LLM provider).
Required status:
- always — needed for the hosted service to function at all
- conditional — only when the customer uses the feature
- self-host-only — only when the customer deploys the self-hosted version
Current sub-processors
| Vendor | Purpose | Required | Location |
|---|---|---|---|
| AWS (us-east-1) | Hosted infrastructure: web application, API, PostgreSQL, Qdrant, object storage | always | United States |
| Anthropic | Claude LLM for code review and Q&A | conditional | United States |
| OpenAI | GPT/Codex LLM for code review, plus OpenAI embeddings for vector indexing | conditional | United States |
| Google (AI Studio) | Gemini LLM for code review | conditional | United States |
| Cohere | Rerank API for retrieval result reranking | conditional | Canada |
| Resend | Transactional email (welcome, daily summary, security notifications) | always | United States |
| Stripe | Payment processing for paid plans | conditional | United States |
| Cloudflare R2 | Object storage for organisation avatars | always | Multi-region |
| GitHub | Repository hosting, webhooks, OAuth, GitHub App installation | conditional | United States |
| GitLab | Repository hosting (Cloud or self-managed), webhooks, OAuth | conditional | Varies (customer-controlled for self-managed) |
| Bitbucket | Repository hosting, webhooks, OAuth | conditional | Varies |
| Slack | Slack integration — posting review notifications, answering Q&A from Slack | conditional | United States |
| Linear | Create issues from review findings | conditional | United States |
| Pubby | Real-time messaging (WebSocket pub/sub) for live chat streaming and the Live Activity dashboard | conditional | United States |
| Atlassian (Jira) | Create issues from review findings | conditional | Varies |
Change notifications
We notify customers of additions or material changes to this list via email and a CHANGELOG entry at least 30 days before the change takes effect, unless the change is required for security or a vendor outage.
Data residency
Hosted Octopus runs in AWS us-east-1. We do not currently offer regional residency options. Self-host if your compliance requirements mandate data residency in a specific region.