Sub-processors

Last updated 29 October 2026.

Engrow Entropy Growth Ltd uses these companies to run Alibi. Customer data at rest stays in the EU, except copies of the emails we send, which Resend keeps in the United States for 30 days. Anthropic runs only for workspaces that turn on AI answers in Ask, and Voyage AI only once we switch on improved search.

  • Railway

    What it does for Alibi
    Runs Alibi's services
    Data it handles
    Customer data while it is processed
    Location
    Netherlands
  • Neon

    What it does for Alibi
    Hosts the database
    Data it handles
    All stored customer data
    Location
    Germany (AWS Frankfurt)
  • Amazon Web Services

    What it does for Alibi
    Holds the encryption keys (AWS KMS)
    Data it handles
    Encryption keys only
    Location
    Germany (Frankfurt)
  • Resend

    What it does for Alibi
    Sends sign-in links and digests
    Data it handles
    Recipient addresses and email content
    Location
    United States
  • Stripe

    What it does for Alibi
    Takes payments and issues invoices
    Data it handles
    Billing contacts and payment details
    Location
    Ireland, with transfers to the United States
  • Anthropic

    What it does for Alibi
    Writes Ask answers in plain words, when a workspace turns this on
    Data it handles
    The question, and the matching records, actions, goals and actor names, including agent owners' names and email addresses
    Location
    United States
  • Voyage AI

    What it does for Alibi
    Builds search embeddings, when we turn this on
    Data it handles
    Goal text and search topics
    Location
    United States
  • Cloudflare

    What it does for Alibi
    Stores export files, once self-serve export ships
    Data it handles
    The export files a workspace asks for
    Location
    EU

Composio is not on this list. Customers connect their own Composio projects, and Alibi reads from them with the customer's own read-only key.

Changes

We add or replace a sub-processor only after updating this page and emailing account owners at least 30 days before the change. Customers can object as the Data Processing Agreement describes.