Subprocessors
Last updated: 2026-05-12
This page lists the subprocessors Carnot Inc. uses to provide the Jinba product. We have a written agreement with each subprocessor that imposes data-protection obligations at least as protective as those in our customer Data Processing Addendum.
To subscribe to subprocessor change notifications, email subprocessor-notice@jinba.io. We provide at least 30 days' prior notice before adding a new subprocessor.
Hosting and infrastructure
| Subprocessor | Function | Region |
|---|---|---|
| Google Cloud Platform | Compute, database, object storage, secrets, DNS, networking | Primary: asia-northeast1 (Tokyo, Japan) |
AI model providers
These providers are invoked only when a customer's workflow uses their models. Customers control which providers are configured per workspace.
| Subprocessor | Function | Region |
|---|---|---|
| OpenAI | LLM inference (GPT family) | United States |
| Anthropic | LLM inference (Claude family) | United States |
| Google AI / Vertex AI | LLM inference (Gemini family) | Multiple (per workspace config) |
For HIPAA-flagged workspaces, AI inference is restricted to BAA-covered providers only. The current list of BAA-covered AI providers is documented in the Business Associate Agreement executed with the Covered Entity customer.
Operational tooling
| Subprocessor | Function | Region |
|---|---|---|
| Sentry | Application error monitoring | United States |
| LaunchDarkly | Feature-flag delivery | United States |
| Inngest | Background job orchestration | United States |
| GitHub (Microsoft) | Source control and CI/CD | United States |
Communications and marketing (jinba.io)
These tools run on our public marketing site and require user consent via the cookie banner before they activate.
| Subprocessor | Function | Region |
|---|---|---|
| Google Analytics 4 | Website analytics (with consent) | United States |
| Mixpanel | Product analytics on jinba.io (with consent) | United States |
| Marketing analytics (with consent) | Ireland / United States |
Billing
| Subprocessor | Function | Region |
|---|---|---|
| Stripe | Payment processing | United States, Ireland |
International transfers
Where a subprocessor is located outside the EEA, UK, or Japan, we rely on the EU Standard Contractual Clauses (and, where applicable, the EU-US Data Privacy Framework) supplemented by the technical and organizational measures described in our Privacy Policy and our customer Data Processing Addendum. A summary Transfer Impact Assessment is available on request.
Notices
We retain ultimate responsibility for our subprocessors' compliance with our customer Data Processing Addendum. Each subprocessor is selected based on a documented vendor risk assessment.