# Sub-processors

> The vendors that process data on Jot's behalf, and what each one sees.

Source: https://docs.usejot.co/docs/legal/subprocessors

Jot uses a deliberately short list of vendors. DPA customers receive notice of
any addition or replacement and have a 30-day objection right — see
[Annex III of the DPA](/docs/legal/dpa#annex-iii--sub-processors).

| Name                    | Purpose                                       | Data categories                                                                              | Location                      |
| ----------------------- | --------------------------------------------- | -------------------------------------------------------------------------------------------- | ----------------------------- |
| Cloudflare R2           | Object storage                                | Screenshots, session recordings                                                              | Automatic (set by Cloudflare) |
| Resend                  | Transactional email                           | Names, email addresses, notification content                                                 | US                            |
| Sentry                  | Error tracking                                | Error reports: stack traces, request URLs, browser and server metadata                       | EU (Germany)                  |
| LLM provider (optional) | AI features, only if a workspace enables them | Comment text and technical context sent for the enabled feature; sent with training disabled | US                            |

**Creem** handles payments as merchant of record. It is an **independent
controller**, not a sub-processor: it receives billing name, email and payment
details directly from the customer at checkout, and that data never touches
Jot's systems.

Last updated: 2026-10-11.