Subprocessors
The companies that help run Polaris, what each one can see and where they process data.
Last updated 1 November 2026.
These companies process data for Polaris. Each is labelled by what it can see, so you know which ones touch your code.
What the labels mean
- Your whole Machine: it runs your Machines, so it can technically read everything on them, including files, memory and credentials, even while they sleep.
- Stores your code: it hosts our servers, database and file storage, which hold Session transcripts, uploads and Machine copies.
- Code in transcripts: it receives transcript text or audio for a Polaris feature. A recap usually includes code.
- Your repositories: it already hosts your code.
- No code: it gets account, billing or operational data only. Names and titles you type can appear there.
Companies we use
| Company | What it does for Polaris | What it can see | Where |
|---|---|---|---|
| Amazon Web Services | Servers, database, file storage, logs, encryption keys | Stores your code | Oregon, USA; global edge network |
| Sail Research | Runs the Machines your agents use | Your whole Machine | Oregon, USA |
| OpenAI (our account) | Session recaps, dictation and voice | Code in transcripts | USA |
| GitHub | Sign-in, and the repository access you grant the Polaris GitHub App | Your repositories | USA |
| Stripe | Payments, invoices and tax. Stripe also uses some payment data for its own purposes, such as preventing fraud | No code: billing and payment details | USA and Ireland |
| PostHog | Product analytics, without cookies | No code: your user ID, email and name, and usage events with typed text masked | EU |
| Sentry | Browser error reports | No code: error details and browser type | EU (Germany) |
| Resend | Account, invitation, billing and beta-request emails | No code: email addresses, names, GitHub usernames and beta-request notes | USA |
| Restate | Workflow coordination | No code: IDs only | USA |
| Vercel | Hosts our documentation site | No code: page requests | Global |
| Telegram | Sends production alerts to our on-call phone | No code: alert text with internal IDs | Global |
Who we contract with
Each company processes data for us only to provide its service, under written data protection terms; Stripe also uses some payment data for its own purposes, as noted above. When one processes personal data outside the EU or UK, we rely on the European Commission’s Standard Contractual Clauses (with the UK Addendum), or on the EU–US Data Privacy Framework where the company is certified.
| Company | Legal entity |
|---|---|
| Amazon Web Services | Amazon Web Services EMEA SARL, Luxembourg |
| Sail Research | Sail Research Co., USA |
| OpenAI | OpenAI Ireland Limited, Ireland |
| GitHub | GitHub, Inc., USA |
| Stripe | Stripe Payments Europe, Limited, Ireland |
| PostHog | PostHog Inc., USA |
| Sentry | Functional Software, Inc., USA |
| Resend | Plus Five Five, Inc., USA |
| Restate | Restate GmbH, Germany |
| Vercel | Vercel Inc., USA |
| Telegram | Telegram Messenger Inc. |
Services you choose
These aren’t our subprocessors. You connect them, and your own agreement with each applies.
- Your model provider (Anthropic, OpenAI, OpenRouter, Google, or your own gateway). It sees the code your agent sends it, which can include whole files.
- MCP servers, Tailscale and cloud accounts you connect. They receive what your agent sends them.
- skills.sh. When you search the skills directory, it receives your search.
- Web push services (Apple, Google, Mozilla or Microsoft, depending on your browser). They deliver notifications if you turn them on. Each notification includes the Session’s title.
Changes
We email every Organization’s Owners at least 7 days before we add or replace a subprocessor that handles your content or personal data, and you can object under our Data Processing Addendum. For other changes, we update this page and the history below.
| Date | Change |
|---|---|
| 1 November 2026 | Added each company’s legal entity |
| 1 November 2026 | First published |