Telos uses a vetted set of third-party service providers ("Subprocessors") to deliver, support, and improve the Telos Services. We share this list to help our customers and their security and privacy teams evaluate Telos and to satisfy disclosure obligations under our Data Processing Addendum.
This page is updated when subprocessors are added or removed. Customers who have signed a Data Processing Addendum will receive advance notice of new subprocessors as required by that DPA. Other readers can subscribe for updates by emailing privacy@gettelos.com.
How to use this list
The "Purpose" column describes why we use the subprocessor. The "Data Categories" column describes the categories of personal information the subprocessor may process on our behalf. The "Location" column describes where the subprocessor's primary processing occurs.
We do not share Customer Data with any subprocessor for that subprocessor's own marketing or product-development purposes.
Infrastructure and Hosting
| Subprocessor | Purpose | Data Categories | Location |
|---|
| [PROVIDER, e.g., Amazon Web Services / Google Cloud Platform] | Cloud hosting and storage of Customer Data and application infrastructure | All Customer Data and account information | United States |
| [Database / managed services provider, if separate] | Managed database services | All Customer Data | United States |
AI and Machine Learning
| Subprocessor | Purpose | Data Categories | Location |
|---|
| Anthropic, PBC | Large language model inference and AI Agent capabilities | Inputs and Outputs as needed to deliver AI features; Anthropic does not retain Customer Data for model training under our terms | United States |
| [Other model providers, e.g., OpenAI, if used] | [Purpose] | [Categories] | [Location] |
Identity and Authentication
| Subprocessor | Purpose | Data Categories | Location |
|---|
| [Auth provider, e.g., Auth0 / Clerk / WorkOS] | User authentication, single sign-on, MFA | Account credentials, authentication metadata | United States |
Connected-Account and Data Aggregation
| Subprocessor | Purpose | Data Categories | Location |
|---|
| [Banking aggregator, e.g., Plaid / Brex API / direct bank APIs] | Authorized access to Customer's banking and financial data | Banking, transaction, and account-balance data as authorized by Customer | United States |
| [Accounting / ERP integration provider, if used] | Synchronization with Customer's accounting systems | Accounting and ledger data as authorized by Customer | United States |
| [HRIS / payroll integration provider, if used] | Synchronization with Customer's HR and payroll systems | Employee, payroll, and benefits data as authorized by Customer | United States |
Payments
| Subprocessor | Purpose | Data Categories | Location |
|---|
| Stripe, Inc. | Processing of Telos subscription payments | Billing contact, payment-card metadata (Stripe handles full PAN data; Telos does not store it) | United States |
Communications and Customer Support
| Subprocessor | Purpose | Data Categories | Location |
|---|
| [Email provider, e.g., Resend / Postmark / Customer.io] | Transactional and marketing email delivery | Email address, name, communication content | United States |
| [Support tool, e.g., Intercom / Zendesk / Plain] | Customer support and in-product chat | Account info, support conversation content | United States |
Analytics and Product Telemetry
| Subprocessor | Purpose | Data Categories | Location |
|---|
| [Analytics provider, e.g., PostHog / Mixpanel / Plausible] | Product usage analytics | Pseudonymous identifiers, usage events, page views | United States |
| [Error monitoring, e.g., Sentry / Datadog] | Error logging and application monitoring | Error logs, request metadata, stack traces | United States |
Business Operations
| Subprocessor | Purpose | Data Categories | Location |
|---|
| [CRM, e.g., HubSpot / Attio] | Sales and marketing CRM | Business contact information of prospects and customers | United States |
| [Document signing, e.g., DocuSign] | Contract execution | Signatory name, email, document metadata | United States |
Notification of changes
We may add or remove subprocessors as we improve the Services or change vendors. For customers under a Data Processing Addendum, we will provide notice of new subprocessors as required by that DPA before the new subprocessor begins processing Customer Data.
To subscribe to subprocessor change notifications, email privacy@gettelos.com with the subject line "Subprocessor Updates."
Questions
For questions about our subprocessors or our security and privacy program, contact us at privacy@gettelos.com.
