Sub-processors
Last updated: May 2026
These are the third-party vendors with potential access to customer data on hosted Octopus. Self-hosted Octopus has none of these by default — your data stays within your own infrastructure unless you explicitly configure an integration that needs an external vendor (e.g. Slack notifications or a non-self-hosted LLM provider).
Forgejo is software run by the operator of the instance you connect. Forgejo's project does not receive your repository data through this integration. Check your instance operator's terms if someone else hosts it. Octopus and the configured AI services still process code for reviews, even when you host Forgejo yourself.
Required status:
- always — needed for the hosted service to function at all
- conditional — only when the customer uses the feature
- self-host-only — only when the customer deploys the self-hosted version
Current sub-processors
| Vendor | Purpose | Required | Location |
|---|---|---|---|
| AWS (us-east-1) | Hosted infrastructure: web application, API, PostgreSQL, Qdrant, object storage | always | United States |
| Anthropic | Claude LLM for code review and Q&A | conditional | United States |
| OpenAI | GPT/Codex LLM for code review, plus OpenAI embeddings for vector indexing | conditional | United States |
| Google (AI Studio) | Gemini LLM for code review | conditional | United States |
| Alibaba Cloud (Model Studio) | Qwen LLM for code review | conditional | Singapore (Alibaba Cloud international region) |
| Cohere | Rerank API for retrieval result reranking | conditional | Canada |
| Resend | Transactional email (welcome, daily summary, security notifications) | always | United States |
| Stripe | Payment processing for paid plans | conditional | United States |
| Cloudflare R2 | Object storage for organisation avatars | always | Multi-region |
| GitHub | Repository hosting, webhooks, OAuth, GitHub App installation | conditional | United States |
| GitLab | Repository hosting (Cloud or self-managed), webhooks, OAuth | conditional | Varies (customer-controlled for self-managed) |
| Bitbucket | Repository hosting, webhooks, OAuth | conditional | Varies |
| Slack | Slack integration — posting review notifications, answering Q&A from Slack | conditional | United States |
| Linear | Create issues from review findings | conditional | United States |
| Pubby | Real-time messaging (WebSocket pub/sub) for live chat streaming and the Live Activity dashboard | conditional | United States |
| Atlassian (Jira) | Create issues from review findings | conditional | Varies |
Change notifications
We notify customers of additions or material changes to this list via email and a CHANGELOG entry at least 30 days before the change takes effect, unless the change is required for security or a vendor outage.
Data residency
Hosted Octopus runs in AWS us-east-1. We do not currently offer regional residency options. Self-host if your compliance requirements mandate data residency in a specific region.