Subprocessors
This page lists the third-party service providers ("Subprocessors") that ADO Pilot engages to Process Personal Data on behalf of its customers. It corresponds to the subprocessor disclosures in our Privacy Policy (Section 5). Our Data Processing Addendum covers the same subprocessors under GDPR Article 28 and is available on request — contact dpo@adopilot.dev.
Azure DevOps is not listed here: it is the customer's own source-code platform, from which we fetch code using the organization's authorized credentials and to which we post review comments. We do not send customer code to Microsoft via Azure DevOps — it is already there. (Azure DevOps appears as an informational entry under Privacy Policy §5.3 for that same reason — it is where your code already lives, not a vendor we engage to Process data on your behalf.)
Current Subprocessors
| Subprocessor | Service Provided | Location | Processing Activities |
|---|---|---|---|
| Anthropic, PBC | AI models (Claude API) | United States | Analysis of source code to generate review comments |
| Microsoft Corporation | Azure cloud infrastructure | United States | Hosting, compute, storage, and networking infrastructure; operational telemetry (server-side, and best-effort from the Azure DevOps browser extension) via Azure Application Insights |
| Stripe, Inc. | Payment processing | United States | Billing contact info, payment metadata |
| Twilio Inc. (SendGrid) | Transactional email | United States | Delivers account and notification emails (recipient email address and message content) |
| Atlassian, Inc. | Support ticketing (Jira Service Management) | United States | Support-requester name, email address, subject, and description; does not receive customer source code or pull-request data |
| Cloudflare, Inc. | Bot and abuse protection (Turnstile) | United States | IP address and browser characteristics from public support form submissions; does not receive customer source code or account data |
| Google LLC | Product analytics (Google Analytics 4) | United States | Pseudonymous client identifier and page/event data on our websites; advertising features and Google Signals off; no name or email sent to Google. EEA/UK/Switzerland visitors are opt-in, elsewhere opt-out; Global Privacy Control honored. Does not receive customer source code or account data |
| Reddit, Inc. | Ad conversion measurement | United States | A Reddit-issued ad click identifier and the fact a signup occurred, sent server-side only when a signup converts; no client-side Reddit script/pixel ever runs in your browser. EEA/UK/Switzerland visitors are opt-in, elsewhere opt-out; Global Privacy Control honored. Does not receive customer source code, name, or email |
A note on Cloudflare's dual role: Cloudflare processes the signals above as our processor to run the Turnstile check on our behalf. Cloudflare's own Turnstile Privacy Policy also states that Cloudflare separately acts as an independent controller of those same signals to improve Turnstile's bot-detection capabilities across its network — a use that is Cloudflare's own, not one we direct or benefit from directly.
Changes to Subprocessors
We will provide at least 30 days' prior written notice before engaging a new Subprocessor that will process Personal Data, or replacing an existing Subprocessor that processes Personal Data. Notice is provided by email to the customer's registered email address and by updating this page subject to the limitations below.
Notice carve-out for non-code subprocessors
The 30-day advance-notice commitment applies to subprocessors that process customer source code. It does not bind for subprocessors that never receive customer source code or pull-request data.
International Data Transfers
Personal Data transferred from the European Economic Area, United Kingdom, or Switzerland to the United States (where ADO Pilot and its Subprocessors operate) is governed by the Standard Contractual Clauses (SCCs) set out in our Data Processing Addendum, available on request — contact dpo@adopilot.dev.
Questions
To request the current subprocessor list or ask about our subprocessor arrangements, contact dpo@adopilot.dev.