Subprocessor List
Last updated: January 21, 2026
This page lists the third-party service providers (subprocessors) that Coplay engages to process customer data in connection with providing our services. We maintain this list to provide transparency about how and where your data is processed.
Data Processing Commitment
All subprocessors listed below are bound by data processing agreements that require them to:
- Process data only as instructed by Coplay
- Implement appropriate security measures
- Maintain confidentiality of customer data
- Not use customer data for their own purposes (including model training)
- Delete or return data upon termination of services
Geographic Commitment
No China Processing: Coplay-controlled customer data is not stored or processed in China, and is not accessible from China by Coplay personnel or our subprocessors. All subprocessors maintain infrastructure and support operations exclusively in the United States and/or European Union. If you choose to use China-based models via OpenRouter, your data may be processed in China as described below.
Infrastructure Providers
| Provider | Location | Purpose | Data Processed |
|---|---|---|---|
| Google Cloud Platform (GCP) | US (us-central1) | Backend hosting, compute, and cloud services | All service data, API requests |
| Amazon Web Services (AWS) | US (us-east-1) | Backend hosting, compute, and cloud services | All service data, API requests |
| Supabase | US (us-west-1) | Database hosting, authentication, file storage | User accounts, application data, uploaded files |
| Google BigQuery | US | Analytics and telemetry storage | Usage analytics, performance metrics (anonymized) |
AI Model Providers
Our primary AI providers operate under API terms of service that prohibit training on customer data submitted through the API.
| Provider | Location | Purpose | Data Processed |
|---|---|---|---|
| OpenAI | US | AI model inference (GPT-4, GPT-4o) | Prompts, code, and generated responses |
| Anthropic | US | AI model inference (Claude) | Prompts, code, and generated responses |
| Google (Gemini) | US | AI model inference (Gemini Pro) | Prompts, code, and generated responses |
| xAI (Grok) | US | AI model inference (Grok) | Prompts, code, and generated responses |
| Mistral AI | EU/US | AI model inference (Codestral) | Prompts, code, and generated responses |
| OpenRouter | US | AI model routing and aggregation | Prompts, code, and generated responses |
| Azure OpenAI | US | AI model inference (alternative) | Prompts, code, and generated responses |
| AWS Bedrock | US | AI model inference (alternative) | Prompts, code, and generated responses |
| Cohere | US | Text reranking and embeddings | Search queries and document snippets |
Important: OpenRouter and China-Based Models
OpenRouter is a routing service that provides access to many AI models, including some from China-based providers. While OpenRouter itself is US-based, selecting certain models can route your data to their respective providers:
| Model | Provider | Data Location |
|---|---|---|
| DeepSeek models | DeepSeek (Hangzhou, China) | China |
| Qwen models | Alibaba (China) | China |
If you select DeepSeek, Qwen, or other China-based models via OpenRouter, your prompts and data will be sent to servers in China. This is outside of Coplay's "No China Processing" commitment, which applies only to our infrastructure and primary AI providers.
Organizations with policies restricting data transfer to China should avoid selecting these models.
Asset Generation Providers
| Provider | Location | Purpose | Data Processed |
|---|---|---|---|
| Meshy | US | 3D model generation | Text prompts, reference images |
| FAL | US | AI inference for asset generation | Text prompts, image data |
| ElevenLabs | US/EU | Audio and voice generation | Text prompts for audio generation |
Payment and Business Services
| Provider | Location | Purpose | Data Processed |
|---|---|---|---|
| Stripe | US | Payment processing | Payment information, billing details |
| UserCheck | US | Email validation | Email addresses (for validation only) |
Observability and Analytics
| Provider | Location | Purpose | Data Processed |
|---|---|---|---|
| LangSmith (LangChain) | US | LLM request tracing and debugging | API request metadata, prompts (for debugging) |
| TurboPuffer | US | Vector storage for embeddings | Text embeddings (anonymized) |
Updates to This List
We will update this subprocessor list when we engage new subprocessors or make material changes to existing relationships. Material changes will be communicated to enterprise customers in accordance with their agreements.
For questions about our subprocessors or data processing practices, please contact us at support@coplay.dev.
Enterprise Customers
Enterprise customers may request additional information about specific subprocessors, including:
- Copies of relevant certifications (SOC 2, ISO 27001, etc.)
- Data Processing Addendums (DPAs)
- Security questionnaire responses
- Custom subprocessor notification arrangements
Contact your account representative or email support@coplay.dev for enterprise-specific requests.