Subprocessors
Last updated: September 21, 2026
Ado, Inc. d.b.a. Bamboo ("Bamboo") uses third-party service providers ("Subprocessors") to assist in providing our Services. This page lists the Subprocessors currently authorized to process Customer Data on behalf of our customers.
What Is — and Isn't — a Subprocessor
A Subprocessor is a third party Bamboo engages and authenticates with its own credentials to process Customer Data in order to deliver the Services. The providers listed below fall into this category.
Third-party platforms that you connect using your own login or credentials — for example, your advertising accounts (Meta, Google Ads, TikTok, LinkedIn), your Slack workspace, your CRM, or any other connector you authorize via OAuth or an API key — are connected platforms, not Bamboo Subprocessors. Bamboo acts as a conduit at your direction; your use of those platforms is governed by your own agreement with each provider. See the "Connected Platforms" section of our Privacy Policy.
Subprocessor List
Infrastructure and Hosting
| Subprocessor | Purpose | Location |
|---|---|---|
| Vercel Inc. | Application hosting and deployment | United States |
| Supabase Inc. | Database hosting, authentication, and edge functions | United States |
| Google Cloud Platform (Google LLC) | Cloud compute for connector/MCP proxy services | United States |
| GitHub, Inc. | Workspace repository hosting — version-controlled storage of knowledge and business context | United States |
AI Model Providers
Bamboo delivers AI-powered features of the Services using its own API credentials with the providers below — directly, and through the OpenRouter gateway. Every provider that receives Customer Data is prohibited under its API terms from using that data for model training. Where you supply your own AI provider account, credentials, or license, that provider is not a Bamboo Subprocessor — it is an underlying provider you connect, governed by your own agreement with it.
| Subprocessor | Purpose | Location |
|---|---|---|
| Anthropic PBC | AI language model provider (Claude) | United States |
| OpenAI, L.L.C. | Text-embedding models for search and retrieval over Customer Data | United States |
| OpenRouter Inc. | AI model routing and API gateway. Bamboo may access additional model providers through OpenRouter for specific features (for example, classification of knowledge content within a customer's own workspace). Routing is restricted to providers located in the United States whose published data policies exclude training on, or storing, API inputs and outputs beyond transient processing; Bamboo keeps OpenRouter's optional prompt-logging and data-sharing settings disabled. | United States |
Analytics and Observability
| Subprocessor | Purpose | Location |
|---|---|---|
| PostHog Inc. | Product analytics and feature-flag management | United States |
| Langfuse GmbH | LLM observability and tracing (prompts, tool calls, and responses) | United States (US cloud region) |
Payments
| Subprocessor | Purpose | Location |
|---|---|---|
| Stripe, Inc. | Payment processing and billing | United States |
Updates to This List
Bamboo may update this Subprocessor list from time to time as we engage new Subprocessors or change existing ones. In accordance with our Data Processing Agreement, we will provide at least thirty (30) days' notice before engaging a new Subprocessor.
Notification of Changes
Updates to this list will be posted on this page with a revised "Last updated" date. We recommend checking this page periodically.
If you have subscribed to Subprocessor change notifications, you will receive an email notification when this list is updated.
Objection Process
Under our Data Processing Agreement, you may object to a new Subprocessor by providing written notice to Bamboo within fifteen (15) days of the notification. To submit an objection, contact us at legal@withbamboo.com.
Data Processing Safeguards
All Subprocessors are bound by contractual obligations that require them to:
- Process Customer Data only as instructed by Bamboo
- Implement appropriate technical and organizational security measures
- Not use Customer Data for their own purposes or for training AI models
- Maintain confidentiality of Customer Data
- Assist with data subject requests as required
- Delete or return Customer Data upon termination
AI Provider Commitments
Every AI model provider that receives Customer Data — the providers named above and any provider accessed through OpenRouter — commits, under its API terms and published data policies, that:
- Customer Data is not used to train, improve, or develop their AI models
- Customer Data is processed solely to provide API responses
- Customer Data is not retained beyond the duration necessary to provide the service
- Appropriate security measures are implemented
OpenRouter itself does not use prompts or responses for model training and does not store prompt or response content unless the account opts in, which Bamboo does not.
Change History
- September 21, 2026 — Added OpenAI, L.L.C. (text-embedding models; in use and previously disclosed in customer security reviews). Added coverage for additional model providers accessed through OpenRouter, subject to the routing restrictions stated above (effective for new providers on or after October 21, 2026).
- May 29, 2026 — Initial list.
Contact
For questions about our Subprocessors, contact us at:
Ado, Inc. d.b.a. Bamboo
Email: legal@withbamboo.com