Legal

Sub-processors

Last updated June 5, 2026. These are the third-party service providers Monad uses to help operate the Service and process data on behalf of customers.

We engage the providers below as sub-processors under our Data Processing Addendum. Each is bound by data-protection obligations no less protective than our DPA and may only process data to provide services to us. Some providers are only used when you enable the related feature (for example, the web tool, push notifications, or SSO).

Current sub-processors

Provider

Purpose

Data processed

Railway

Application hosting (compute) and object storageRuns the application; stores files, attachments, and canvas data

Runs the application; stores files, attachments, and canvas data

Supabase

Managed PostgreSQL database and S3-compatible object storageWorkspace content, account and usage data; files, attachments, and canvas data

Workspace content, account and usage data; files, attachments, and canvas data

Cloudflare

Content delivery network (CDN) and traffic analyticsRequest metadata (e.g., IP address) and aggregated usage analytics

Request metadata (e.g., IP address) and aggregated usage analytics

OpenRouter

AI model inference routing for agent runsContent relevant to an agent run (prompts and context)

Content relevant to an agent run (prompts and context)

Firecrawl

Web search and page retrieval for the web toolSearch queries and URLs an agent requests

Search queries and URLs an agent requests

Stripe

Payments and usage-based billingBilling contact and payment details; usage metering

Billing contact and payment details; usage metering

Resend

Transactional email (verification, security, billing)Email address and message content for that email

Email address and message content for that email

Apple (APNs) & Google

Push notifications and optional sign-in (SSO)Device push tokens; authentication identifiers if you use SSO

Device push tokens; authentication identifiers if you use SSO

Customer-enabled connections

Beyond the providers above, your workspace can connect tools you choose — such as third-party MCP servers or your own AI provider key (BYOK). Data flows to those destinations as you configure them, and they operate under their own terms. These are controlled by you, not engaged by us as sub-processors.

Where data is processed

Our hosting and storage providers process data in the United States. Our CDN (Cloudflare) may process request metadata, such as IP address, at edge locations worldwide while delivering the Service. Beyond hosting and delivering the Service, these providers don’t access Customer Content in the ordinary course.

Changes to this list

We update this page when our sub-processors change. To be notified of material changes, email [email protected] and ask to be added to our sub-processor notification list.