Subprocessors

Last updated: October 3, 2026

Metalcraft Inc uses the providers below to operate UFO. A provider processes the information described in our Privacy Policy only when its service is needed or when a member uses the related feature.

Depending on the service, the data can include account and contact details, conversation and connected-service content, files, authorization data, and usage or diagnostic records. A provider does not receive all these categories merely because it appears on this list. Customer-directed destinations are separate from providers acting for UFO.

Infrastructure

• Amazon Web Services: Compute, networking, databases, file storage, email delivery, and optional model inference through Amazon Bedrock
• Cloudflare: Web delivery, edge security, DNS, and feature flags

AI and search

• OpenRouter: Model routing. Zero data retention applies at OpenRouter when prompt logging is disabled. The model provider's retention terms depend on the selected endpoint.
• Fireworks AI: Optional model inference with zero data retention for eligible requests under its terms and our configuration.
• Baseten: Optional model inference with zero data retention for eligible requests under its terms and our configuration.
• Anthropic: Optional model inference. Zero data retention applies to eligible requests covered by our agreement, excluding Fable.
• Google Vertex AI: Optional model inference through OpenRouter. Zero data retention applies to eligible requests under OpenRouter's ZDR routing policy.
• Moonshot AI and DeepSeek: Optional model inference when a workspace selects a related model
• OpenAI: Vector embeddings and optional model inference
• Perplexity: Web research. Zero data retention applies to eligible requests covered by our agreement.
• Exa: Web research
• Turbopuffer: Search and memory indexing

Zero data retention

Zero data retention (ZDR) applies to model prompts and responses for covered requests. Coverage depends on the provider, model, endpoint, feature, and agreement. Provider terms may allow temporary memory caches, usage metadata, and retention required by law or for safety review. ZDR does not apply to UFO's stored conversations, files, or memory, or to separate tools and connected services. OpenAI processing is not covered by our ZDR commitment.

See the provider terms for OpenRouter, Baseten, Fireworks AI, Anthropic, and Google Vertex AI.

Tools and connections

• E2B: Isolated code and tool execution
• Browserbase: Remote browser sessions
• Composio and Pipedream: Account connections and actions in connected services
• Slack: Optional messaging when a workspace connects Slack
• Photon (Spectrum Cloud): Optional iMessage delivery when a member uses the iMessage surface

Accounts and operations

• WorkOS: Authentication and account identity
• People Data Labs: Company and role information used during onboarding
• Stripe: Payment methods and billing management
• Metronome: Usage metering and account balances
• Datadog: Service monitoring, error reports, and masked web session recordings
• Vanta: Compliance monitoring and audit evidence, including personnel access records, cloud configuration, and security documents. Security and privacy information.

Changes

Changes to this list appear on this page with a new update date. For customers with an agreed Data Processing Addendum, its notice and objection terms apply.

Contact

For questions about a provider or its use of data, email support@ufo.ai.