// Legal
Sub-processors
This page identifies providers used to operate Watson and the services they support. Read it with our Privacy Policy, Cookie Policy, and Regional Privacy Supplement. A listed provider is a sub-processor when it processes personal information on our behalf as part of processing we perform for a customer. Its role may differ for other activities, such as its own payment-compliance obligations or a third-party service you choose to use.
The list does not mean every provider receives every customer’s information or that every optional capability is enabled. A capability such as session replay depends on the service configuration and applicable privacy choices. Watson does not currently use customer content to train or fine-tune AI models, including through our service providers.
A provider listing does not itself establish a data processing agreement, international transfer safeguard, or permission to use information for new purposes. Applicable agreements and privacy obligations continue to govern.
| Sub-processor | Applicable Services | Processing Activities | Location |
|---|---|---|---|
| Convex | Hosted application backend: database, functions, authentication, file storage, and real-time subscriptions. | Hosts and processes Watson account, profile, workspace, project, message, file, and authentication data to operate the application. | United States |
| Stripe, Inc. | Billing, subscriptions, payment processing, and connected-account onboarding. | Processes billing contact details, account identifiers, subscription and invoice records, payment metadata, and payment details needed to provide billing services. | United States, European Union, United Kingdom |
| Resend (Plus Five Five, Inc.) | Transactional and inbound email delivery. | Processes sender and recipient addresses, email content, and delivery events to send transactional messages and handle inbound email. | United States |
| PostHog, Inc. | Product analytics, feature flags, and session replay. | Processes pseudonymous identifiers, application events, page and interaction data, feature-flag requests, and session-replay data to measure and improve product usage. | United States |
| Cloudflare, Inc. | Application hosting on Workers, DNS, content delivery, bot protection (Turnstile), and R2 object storage. | Processes IP addresses and request metadata to route and secure web traffic; stores and delivers user-uploaded files and assets. Edge services operate across Cloudflare’s global network. | United States, European Union, United Kingdom |
| Sanity AS | Hosted content management system and Content Lake for marketing content. | Stores and delivers draft and published CMS content and processes editor account, usage, and service data needed to operate the content platform. | United States, European Union, United Kingdom |
| GIPHY, Inc. | GIF search and media delivery in conversation editors. | Receives GIF search terms and request metadata, including IP and device information, and returns matching GIF results and media. | United States |
Changelog
Each version below is the full list as it stood on that date.
Version 2026-09-21--01
Effective September 21, 2026