These companies process personal data so Tabla can work. Each is bound by contract to use it only on our instructions. Customers who accept our Customer Data Agreement get 30 days' notice by email before we add one.
Subprocessors#
| Company | Role, what it receives, where, and its terms |
|---|---|
| Amazon Web Services | Hosting, database, storage, keys. Receives: What Tabla stores. Where: US (Virginia). DPA · Security |
| Nylas | Connects Google and Microsoft accounts. Receives: Mail, calendar and contacts in transit; it holds the access to each account, so it can technically reach its contents. Security |
| Anthropic | AI models. Receives: The content AI features use, when asked and in the background (sorting, briefs); no training. DPA · Trust |
| Parallel | Web search for apps you build. Receives: Only your request’s words. Trust |
| Stripe | Payments made on the web. Receives: Your subscription and payment details; Tabla never receives your full card number. DPA |
| PostHog | Product analytics, server-side. Receives: Event counts and timings, random identifiers. DPA |
| Mixpanel | Product analytics. Receives: Event names, account identifiers and counts. DPA |
| Slack | Only if you connect it. Receives: The access you grant. DPA |
During our move to AWS, our previous providers keep what they held until November 6, 2026, when we close those accounts: Supabase, a copy of our database, encrypted at rest by Supabase; and Vercel, our request logs and service settings.
Not subprocessors#
- Google and Microsoft, where your mail lives.
- Public sites and feeds, which receive nothing about you.