Legal
Sub-processors
The vendors that process data on Jot's behalf, and what each one sees.
Jot uses a deliberately short list of vendors. DPA customers receive notice of any addition or replacement and have a 30-day objection right — see Annex III of the DPA.
| Name | Purpose | Data categories | Location |
|---|---|---|---|
| Cloudflare R2 | Object storage | Screenshots, session recordings | Automatic (set by Cloudflare) |
| Resend | Transactional email | Names, email addresses, notification content | US |
| Sentry | Error tracking | Error reports: stack traces, request URLs, browser and server metadata | EU (Germany) |
| LLM provider (optional) | AI features, only if a workspace enables them | Comment text and technical context sent for the enabled feature; sent with training disabled | US |
Creem handles payments as merchant of record. It is an independent controller, not a sub-processor: it receives billing name, email and payment details directly from the customer at checkout, and that data never touches Jot's systems.
Last updated: 2026-10-11.