Keyway Subprocessor List
Effective date: [[EFFECTIVE DATE]] This schedule is referenced by the Privacy Policy and by the Data Processing Addendum.
1. How to read this
A subprocessor is a third party we engage that may handle data on our behalf. It is not the same as a service you connect with your own account and your own credential, and this schedule keeps the two apart, because in this product most of the second kind never becomes the first.
Which of these apply to you depends entirely on how you run Keyway.
| If you run | Your subprocessors |
|---|---|
| Solo | Stripe, for billing. Nothing else, by default |
| Office | Stripe, for billing. Nothing else, by default |
| Hosted | Stripe, and our infrastructure providers in section 2 |
2. Subprocessors we engage
2.1 Every customer
| Subprocessor | What they do | What they receive | Where |
|---|---|---|---|
| Stripe, Inc. | Payment processing, subscription billing, invoicing | Your billing contact details and your card data, which you give to Stripe directly. Never your business content, never recordings, never transcripts | United States |
2.2 Hosted residency only
| Subprocessor | What they do | What they receive | Where |
|---|---|---|---|
| Amazon Web Services, Inc. | Compute, database, object storage, key management, logging | All customer data in the Hosted residency | United States, region us-east-2 |
| Cloudflare, Inc. | Edge network and TLS termination in front of the Hosted service | Traffic in transit to and from the Hosted service | United States |
2.3 Model providers, if the vendor path is switched on
The product can reach a language or transcription model in three ways:
- On your own machine or network. No third party is involved. This is the default.
- A provider you configure with your own key. That provider is your supplier, not ours. Your contract is with them and your data reaches them on your instruction. See section 3.
- A provider we contract with, billed to you as vendor inference credits. That provider is a subprocessor, and it is named below.
| Subprocessor | What they do | What they receive | Where |
|---|---|---|---|
[[INFERENCE PROVIDER, IF ANY]] | Transcription or text generation for features you enable | Only the audio or text sent for that operation | [[REGION]] |
No vendor model provider is engaged at the date of this schedule. If one is engaged, this row is filled in and customers are notified under section 4 before it is used.
3. Services you connect, which are not our subprocessors
These handle your data because you connected them, using your account. They are listed so the picture is complete, not because we engage them.
| Service | Why it appears | What it receives |
|---|---|---|
| Your Microsoft 365 or Google mailbox | You connected it so the product can send mail as your business | The recipient's address and the message, delivered by your provider from your mailbox. Nothing is relayed through us and we keep no copy |
| Your model provider, where you supply the key | You configured it | Only what you send for each operation |
| Your identity provider, if you use single sign-on | You configured it | Sign-in only |
The distinction has a practical consequence. Because mail goes through your own provider, an outage, a retention policy or a legal request affecting your mail is a matter between you and your provider, and we are not a party to it.
4. Changes to this list
- We will publish an updated version of this schedule before a new subprocessor begins handling customer data.
- Hosted customers will be notified at least 30 days in advance, and may object in writing under the Data Processing Addendum.
- Solo and Office customers are unaffected by additions to section 2.2, because those subprocessors handle nothing of theirs.
5. Contact
Questions about this list: [[PRIVACY EMAIL]].