# Cogs Subprocessors

**Last updated: October 17, 2026**

Cogs uses third parties to help provide the Service. A **subprocessor** is a provider that may process Customer Personal Data on Cogs' behalf. Some customer-selected integration providers may also act independently under their own terms for parts of their services.

## Current Production / Launch Providers

| Provider | Purpose | Typical data involved |
|---|---|---|
| Anthropic | Commercial/API AI processing | Prompts, transaction context, instructions, and outputs necessary for AI accounting features |
| Plaid | Customer-authorized financial connectivity | Financial-account metadata and transaction information authorized by the customer; Plaid handles the authentication flow and does not provide bank-login credentials to Cogs |
| Shopify | Customer-authorized commerce integration | Store, order, product, customer, payment/refund, tax, shipping, discount, and related commerce data authorized by the merchant |
| Supabase | Application database and authentication infrastructure | Account, authentication, application, and Customer Data stored or processed by Cogs |
| Railway | Application/backend hosting | Application traffic, logs, and Customer Data processed by hosted Cogs services |
| Cloudflare | DNS, network delivery, and security | IP address, request/network metadata, security events, and traffic routed through Cloudflare services |
| Resend | Transactional/service email delivery | Recipient email address, message metadata, and message content sent through the service |
| Google Workspace | Business email and customer communications | Contact information and message content sent to or from Cogs personnel |

**Publication condition:** this table must match the actual production architecture. Engineering must remove any provider that is not used as described and add any production provider that processes Customer Personal Data before the page is published. In particular, any future analytics, error tracking, session replay, support, observability, or additional hosting provider must be reviewed for inclusion.

## AI Data Practices

Cogs uses Anthropic commercial/API services. Anthropic's current commercial policy states that commercial inputs and outputs are not used to train Anthropic's general models by default. Cogs does not knowingly opt Customer Data into third-party general-model training.

Cogs may use feedback and user actions such as categorization confirmations, corrections, and rule changes to improve Cogs' own accounting automation. Generalized or cross-customer improvement is performed using aggregated, deidentified, or otherwise transformed information that is not reasonably linked to Customer or an identifiable individual, unless Customer separately authorizes another use or applicable law permits it.

## Changes and Objections

Cogs may add or replace providers as the Service evolves. Where a contractual or legal obligation requires notice of a new subprocessor, Cogs will provide notice through the Service, email, this page, or another reasonable method.

A Customer with an applicable DPA may object to a new subprocessor on reasonable data-protection grounds as described in that DPA.

Questions may be sent to **legal@getcogs.ai**.

---

**Operator:** Spear America LLC, 1021 E Lincolnway, Ste 6344, Cheyenne, Wyoming 82001, United States  
**Service:** Cogs (GetCogs.ai)  
**Legal contact:** legal@getcogs.ai