Outlay Subprocessors Security DPA Start free trial

Subprocessors

The third-party services Outlay relies on to deliver the product. We'll keep this page current and give notice of material changes.

Important: in the default self-hosted / thin-client deployment, your prompt content goes directly from your infrastructure to Anthropic using your own API key — it does not pass through Outlay, so Anthropic is your model provider, not Outlay's subprocessor for prompt content. In the optional hosted-gateway deployment, request content is processed in memory by Outlay only to route it (read by our classifier to select a model) and is not persisted. Except for that transient routing in hosted mode, the services below process only account data and aggregate/opt-in metadata.

SubprocessorPurposeData processed
AnthropicClaude model inference (called directly by your gateway with your key)Your prompts & outputs — sent by you, not via Outlay
Cloud hosting provider
(our brain / console / ingest)
Runs Outlay's backend servicesAccount data, aggregate savings, opt-in metadata — no prompt content. In hosted-gateway mode, also transiently processes request content in memory for routing (not stored).
StripePayments & subscription billingBilling contact & payment details (held by Stripe), usage amounts
Email provider
(transactional email, if configured)
Password resets, budget & review alertsEmail address, message content of the notification

This list reflects our current architecture. We will list the specific hosting and email vendors by name here before onboarding any customer that requires a named-subprocessor list (e.g., under GDPR Art. 28); contact us for the specifics applicable to your account. To be notified of changes, email [email protected].

← Security & trust · DPA