How it worksPricingServicesDevicesAboutFree assessment

Find where AI pays off in your business, and prove the return. A Logicly company.

Product

  • How it works
  • Pricing
  • The assessment
  • Graft Devices

Company

  • Services
  • About
  • Contact

Industries

  • AI for law firms
  • AI for accountancy firms

Resources

  • Blog

Legal

  • Privacy
  • Terms
  • Data protection FAQ
  • Sub-processors
© Logicly Ltdgraft.bot

Graft is a trading name of Logicly Ltd, registered in England and Wales, company number 08378826. Registered office: Suite A 82 James Carter Road, Mildenhall, Suffolk, England, IP28 7DE.

  1. Home
  2. /Sub-processors

Sub-processors

When you connect your systems to Graft, we process personal data for you as your processor. These are the companies that help us do it.

Last updated 8 October 2026

Who we use

  • Vercel Inc.

    What they do
    Application hosting and serverless compute. Its AI Gateway routes every AI model request. It also stores the step state of agent runs and holds runtime logs.
    What they handle
    All platform activity, in transit and in logs, including agent step inputs and outputs.
    Where
    Vercel Inc. is a United States company. Application servers run in London, United Kingdom. The edge network and CDN are global.

  • Neon (Databricks, Inc.)

    What they do
    Postgres database and its backups.
    What they handle
    Everything Graft stores for you.
    Where
    London, United Kingdom (AWS eu-west-2).

  • Nango, Inc.

    What they do
    Secure connections to the systems you connect. It holds the access tokens and passes each API call through to those systems.
    What they handle
    Access tokens, and every API response from the systems you connect.
    Where
    United States.

  • Anthropic, PBC

    What they do
    AI models for the assessment chat and for agents.
    What they handle
    Chat messages, and agent prompts and outputs.
    Where
    United States.

  • OpenAI, L.L.C.

    What they do
    AI models for agents, only where your model policy allows them.
    What they handle
    Agent prompts and outputs.
    Where
    United States.

  • Amazon Web Services (Bedrock)

    What they do
    A possible host of Anthropic models, when the AI Gateway routes a request to it.
    What they handle
    As for Anthropic.
    Where
    Not fixed. The AI Gateway chooses the provider that serves each request.

  • Google Cloud (Vertex AI)

    What they do
    A possible host of Anthropic models, when the AI Gateway routes a request to it.
    What they handle
    As for Anthropic.
    Where
    Not fixed. The AI Gateway chooses the provider that serves each request.

  • Microsoft Azure (Azure OpenAI)

    What they do
    A possible host of OpenAI models, when the AI Gateway routes a request to it.
    What they handle
    As for OpenAI.
    Where
    Not fixed. The AI Gateway chooses the provider that serves each request.

  • Stripe

    What they do
    Billing, card payments and tax calculation.
    What they handle
    Billing contact name, email and address, and your VAT number. Stripe alone holds card details.
    Where
    Stripe is a United States company. It processes payments in several countries.

  • Functional Software, Inc. (Sentry)

    What they do
    Error monitoring.
    What they handle
    Error context, and incidentally a user identifier or IP address.
    Where
    United States.

  • Resend, Inc.

    What they do
    Transactional email: verification, password reset, invitations and notifications.
    What they handle
    The name and email address of the person we write to, and the message itself.
    Where
    Emails are sent from Ireland (AWS eu-west-1). Resend, Inc. is a United States company.

  • Cloudflare, Inc.

    What they do
    Graft Devices only: storage of Devices session audit records. Not used for the connected assessment or for agents.
    What they handle
    Devices session records.
    Where
    Cloudflare, Inc. is a United States company.

How data reaches AI models

Every AI model request that carries customer data goes through Vercel's AI Gateway. Each request asks the gateway to use only providers that keep no data and do not train on prompts, and we refuse any model that cannot meet that standard.

We do not pin the gateway to one provider, so it decides which provider serves a request. An Anthropic model, for example, may be hosted by Anthropic, Amazon Web Services (Bedrock) or Google Cloud (Vertex AI). An OpenAI model may be hosted by OpenAI or by Microsoft Azure. That is why Bedrock, Vertex AI and Azure are on the list.

International transfers

Several of these companies are in the United States. Where a provider is outside the UK, the transfer is covered by the safeguards in that provider's data processing terms, such as the UK-US data bridge or the ICO's international data transfer addendum.

Changes to this list

We give customers at least 30 days' notice before we add or replace a sub-processor. We email the contact you give us and update this page. If you object on reasonable data protection grounds, tell us within that period. If we cannot resolve it, you can end the affected service. In an emergency affecting security or continuity we may change a sub-processor first and tell you as soon as we can.

To get change notices by email, subscribe through our contact form, or email privacy@graft.bot.

Your own providers

The systems you connect to Graft, such as Google Workspace, Microsoft 365, Linear and Twenty, are your own providers. You engage them directly. If you connect Graft Devices through a Tailscale network that you own, and Graft holds no credentials for it, Tailscale is your provider as well.

Contract documents

Our data processing addendum and processor DPIA pack are available to customers and prospective customers. Request the DPA and DPIA pack. You can also read the data protection FAQ and our Privacy Policy.

Graft is a trading name of Logicly Ltd, company number 08378826, registered in England and Wales.