Subprocessors
Last updated: October 26, 2026
DeepFirst uses the providers below to run the Platform. They process personal data only on our instructions and under a data processing agreement. This list is part of our Privacy Policy and of the data processing agreement (DPA) we sign with our customers.
The AI providers used to simulate answers (OpenAI, Anthropic, Google) receive prompt text and scenario context, with target-country information where supported. Oxylabs receives prompt text as a search query, with the target country. Azure AI Foundry additionally receives brand information, collected responses, source information and aggregated operational metrics for analysis and service operation. We do not automatically attach account names, email addresses or account IDs to AI-provider requests. Submitted content and collected responses may nevertheless contain personal information. Each provider’s own terms govern how it handles the content it receives.
We update this page before we add or replace a subprocessor. Customers who signed our DPA are notified in advance, as set out in the DPA, and may object.
To receive our DPA or ask a question about this list, write to support@deepfirst.ai.
Hosting and infrastructure
Microsoft Azure
Microsoft Ireland Operations Ltd
- Purpose
- Hosting of the Platform and its collection worker, database, job queue, secrets management, technical logs and scheduled jobs. Sending of internal summary emails (Azure Communication Services Email).
- Data processed
- All Platform data (accounts, brand and prompt configuration, collected AI responses, technical logs).
- Location
- European Union. Core infrastructure in the Azure “France Central” region (France). Internal summary emails via Azure Communication Services Email, “Europe” data location.
- Transfer safeguards
- Governed by Microsoft’s DPA (Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework) for any access from a third country.
AI models and data collection
Azure AI Foundry (Azure OpenAI)
Microsoft Ireland Operations Ltd
- Purpose
- Website analysis when a brand is set up (including web search), prompt suggestions, analysis of collected AI responses (mentions, sentiment, sources), source categorisation and an internal daily operations summary.
- Data processed
- Brand URL and information (name, description, industry, competitors), prompts, collected AI responses and the target brand, cited sources’ domains, URLs and titles, aggregated operational metrics. No account name, email or ID is attached automatically.
- Location
- Resource hosted in the “France Central” region. Depending on the model deployment type, inference may be processed in another Azure region, including outside the EU. Web searches go through Microsoft’s Bing service.
- Transfer safeguards
- Governed by Microsoft’s DPA (Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework) for any access from a third country.
Oxylabs
- Purpose
- Collection of Google search results (AI Overview, AI Mode) for the prompts you configure.
- Data processed
- Prompt text (search queries) and target country. No account name, email or ID is attached automatically.
- Location
- Lithuania (EU). Queries may be run from the target country.
- Transfer safeguards
- Provider established in the EU. Any transfer is governed by its DPA.
OpenAI API
OpenAI
- Purpose
- Querying OpenAI models (the “ChatGPT” surface), including web search, with the prompts you configure.
- Data processed
- Prompt text and scenario context, with target-country information where supported. No account name, email or ID is attached automatically.
- Location
- United States.
- Transfer safeguards
- European Commission Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.
Anthropic API
Anthropic
- Purpose
- Querying Anthropic models (the “Claude” surface), including web search, with the prompts you configure.
- Data processed
- Prompt text and scenario context, with target-country information where supported. No account name, email or ID is attached automatically.
- Location
- United States.
- Transfer safeguards
- European Commission Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.
Google Gemini API
Google LLC
- Purpose
- Querying Gemini models (the “Gemini” surface), grounded in Google Search, with the prompts you configure.
- Data processed
- Prompt text and scenario context, with target-country information where supported. No account name, email or ID is attached automatically.
- Location
- United States.
- Transfer safeguards
- European Commission Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.
Accounts, billing, analytics and support
Auth0
Okta, Inc.
- Purpose
- Authentication, management of accounts, organisations and invitations, verification and invitation emails.
- Data processed
- Name, email address, password (stored hashed), profile picture, organisations and roles, sign-in logs (IP address, browser, date).
- Location
- European Union (EU-hosted Auth0 tenant).
- Transfer safeguards
- Data hosted in the EU. Access from the United States for support is governed by Okta’s DPA (Standard Contractual Clauses and, where applicable, the Data Privacy Framework).
Stripe
Stripe Payments Europe, Ltd
- Purpose
- Subscription payments, invoicing, VAT calculation and the billing portal.
- Data processed
- Billing email, name and address, VAT number, payment method, invoices and payment history, plus internal organisation and brand IDs and the brand name (metadata).
- Location
- Ireland (EU), with processing by other Stripe group entities, including in the United States.
- Transfer safeguards
- European Commission Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.
PostHog
PostHog, Inc.
- Purpose
- Product analytics, session recordings, heatmaps, error tracking, application logs and technical monitoring of AI model calls.
- Data processed
- User ID, name, email, organisation, role and plan, pages viewed, clicks, session recordings (currently enabled, input fields masked), browser console messages, errors, device and browser, application logs. IP addresses are discarded by our project setting. AI-call tracing omits raw inputs and outputs by default; application logs can contain query excerpts, generated prompt text and error details.
- Location
- European Union (PostHog EU Cloud, Frankfurt, Germany).
- Transfer safeguards
- Data hosted in the EU. Access from a third country for support is governed by PostHog’s DPA (Standard Contractual Clauses, where applicable).
Microsoft 365
Microsoft Ireland Operations Ltd
- Purpose
- Email (the support@deepfirst.ai mailbox) and internal team chat that receives technical alerts.
- Data processed
- Content of the emails you send us, technical alerts that may contain user or organisation identifiers.
- Location
- European Union (Microsoft EU Data Boundary).
- Transfer safeguards
- Governed by Microsoft’s DPA (Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework) for any access from a third country.
Linear
Linear Orbit, Inc.
- Purpose
- Tracking of feedback and bug reports sent from the Platform’s built-in feedback tool.
- Data processed
- Name, email, user and organisation IDs, message, screenshot of the page (not masked: it can contain displayed data and form contents), URL, browser and window size, an HTML excerpt (at most 400 characters) of the selected element and, if available, a link to the session recording.
- Location
- United States.
- Transfer safeguards
- European Commission Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.