These are the third parties that may receive data while providing INFRO. Infrastructure vendors process data on our behalf and form part of our data processing agreement. Payment providers may instead act as independent controllers for buyer information, as identified below. The list is kept current — see Changes below for how you are told when it moves.
Infrastructure
| Subprocessor | Role | What it processes | Location |
|---|---|---|---|
| Cloudflare, Inc. | Compute, edge network, object storage, key-value cache, email delivery | All API traffic in transit. Generated media at rest. Transactional email bodies and recipient addresses. | Global network; requests enter at the location nearest the caller, and the gateway runs in Frankfurt |
| Neon, Inc. | Managed PostgreSQL — the source of truth for accounts, usage records, policies and subscriptions | Account and organisation records, API key hashes, sealed provider credentials, usage metadata and cost estimates, the audit log. Prompt and completion content only if you have opted in to logging. | eu-central-1 (Frankfurt) |
| PostHog, Inc. | Product analytics and session replay for infro.io and the console (2026-10-14) | Page views and clicks on infro.io and dash.infro.io. Unless the visitor declines (on by default; Do Not Track and Global Privacy Control turn it off): an analytics cookie, session recordings, and in the console the signed-in person's account id, email address and name with their organisation, role and plan. Never API traffic, form-field values, keys, prompts, model output or request content — recordings mask them in the browser before anything is sent. | EU Cloud, Frankfurt (AWS eu-central-1) |
Payment providers
Subscriptions are sold through Polar, which receives the information needed to complete and support that transaction. Payment providers do not receive API request content: no prompts, no completions, and no API keys. As merchant of record Polar is an independent controller of buyer information, and its own privacy policy applies in addition to ours. It is also named at checkout and on every receipt.
| Subprocessor | Role | What it processes | Location |
|---|---|---|---|
| Polar Software, Inc. | Merchant of record for INFRO subscriptions: resells the subscription to you, takes the payment, and handles sales tax and VAT, receipts, refunds, and chargebacks. Card payments are processed for Polar by Stripe, Inc. | Buyer identity and contact data, payment method details, tax location, transaction records, receipts, refunds, and fraud signals. Card details are entered on Polar's hosted checkout and never reach INFRO. | United States (Delaware company); Polar may transfer data to the United States, Canada and other countries outside the EEA and UK under its own safeguards, such as Standard Contractual Clauses |
AI providers you connect
INFRO does not engage any AI provider on your behalf. You connect provider accounts you already hold. The contract is between you and that provider, you accepted their terms, and you are responsible for selecting suitable data-processing terms. When your request reaches OpenAI or Anthropic or Bedrock, it reaches them under your credentials on your account — exactly as it would if your application had called them without INFRO in the path.
Your model-provider agreements govern their retention, processing locations and data use. INFRO's logging settings do not change those agreements or settings. Each party's data-protection role depends on its actual processing and the applicable agreements. The infrastructure list above identifies vendors engaged by INFRO; payment providers' separate roles are described alongside them.
You can see the provider connections configured for your workloads and identify attempted connections in request traces. Retries and fallbacks can send the same input to multiple configured providers.
If an agreement with INFRO ever includes capacity we provide ourselves rather than routing to your own accounts, the providers behind it are named in that agreement before it is signed. It is not part of the standard product and nothing on this site sells it.
Data handling boundaries
- Your prompts and completions are not stored by default. Content logging is a per-organisation opt-in with a retention window allowed by your plan. Job records and generated media required for delivery are separate from optional request logs. See privacy.
- INFRO does not train on or sell your data. Your connected AI providers' data-use policies are governed by your own agreements and account settings with them.
- No analytics vendor sees API traffic. PostHog measures the website and the console only, and stops recording when a visitor declines; the API carries no analytics. See privacy.
Changes
We add subprocessors as the platform grows. Adding a model provider is not one of them — those are yours, not ours. Account owners are notified by email at least 30 days before a new subprocessor begins processing customer data, and you may object in writing during that window; if we cannot accommodate an objection, you may terminate the affected processing. Your subscription remains available for compatible INFRO services and is governed by the refund policy.
Emergency additions — infrastructure brought in to restore service during an outage — are notified within 72 hours instead, because the alternative is an outage we could have ended sooner.
Questions, or a vendor questionnaire to complete: sales@infro.io.