Alter — Sub-processor list
Last updated: 2026-07-07 (draft)
Third parties that process customer data on alter's behalf:
| Sub-processor | Purpose | Data touched | Region | Retention / training posture |
|---|---|---|---|---|
| Anthropic PBC | AI processing (recognition, compilation, responses) | Capture-derived text | US | No training on API data (published policy); ~30-day standard API retention; enterprise zero-retention planned before public GA |
| OpenAI LLC | AI processing (fallback provider) | Capture-derived text | US | Same posture as Anthropic |
| Perplexity AI, Inc. | Explore-mode web search (Sonar API) | Research queries derived from captures | US | Published zero-data-retention + no-training Sonar API policy (policy-based, not contractual) |
| Stripe, Inc. | Payments, subscriptions, invoicing | Email, billing details, payment method (Stripe-held) | US/EU | Independent controller for payment records (legal retention obligations) |
| Hetzner Online GmbH | Infrastructure hosting | All service data (encrypted at rest) | Germany (EU) | Hosting only |
| Cloudflare, Inc. (R2) | Encrypted database backups + object storage | Encrypted archives, uploaded files | EU jurisdiction | 30-day rolling backup retention |
| Functional Software, Inc. (Sentry) | Error monitoring | Error reports (content-scrubbed before send) | EU (Sentry EU region) | Content keys stripped client-side by privacy scrubber |
Sign-in with Google (Google Ireland Ltd.) acts as an identity provider when you choose it — we receive your email and Google account identifier; no alter content flows to Google.
Changes to this list are announced to account holders before new sub-processors receive customer data.