Subprocessors · v0.1
Subprocessors
The companies Kiff Agents OÜ uses to run KIFF Cloud and tafs that handle personal data on its behalf. This is the official list. The Data Processing Agreement governs how we engage them. Questions: privacy@kiff.dev.
1. The list
| Subprocessor | What it does for KIFF | Data it touches | Location |
|---|---|---|---|
| Amazon Web Services | Hosting: the servers, the database and its backups, key management, secrets and monitoring. For tafs, its own store and planque's connections | Everything KIFF keeps: accounts and the people who sign in, Cards, decisions, receipts, logs. For tafs, runs, chats, memory notes, and connection tokens (encrypted) | United States (us-east-1): KIFF Cloud and the tafs service. Ireland (eu-west-1): where tafs's runs, chats and model calls happen, and planque |
| Clerk | Identity: sign-in and sessions for KIFF accounts | The email address and name of the people who sign in, their sessions, IP address, device and browser, and the identity from Apple, Google or GitHub when someone signs in with one of them | United States |
| Stripe | Payment: checkout, invoices and the billing portal on a paid plan | The billing contact and payment details entered at Stripe's checkout, and the usage counts reported for invoicing | EU and United States |
| Resend | Email: held-call and Card-warning notices, usage and account notices, and support replies | The recipient's email address and the notice. A held-call notice names the agent, the action, its amount and the Card it is outside of | United States |
| Apple | Push notifications: held-call alerts to devices registered in the tafs app (Apple Push Notification service) | The device's push token and the alert. No request details | United States |
| Anthropic | AI models: the model each taf uses (Claude API). tafs only | What a taf sends the model during a run, which can include what your tools returned, and the model's reply. Anthropic deletes it within 30 days by default, longer where law, its usage policy or its terms require | United States, called from Ireland (eu-west-1); inference may run in the United States, Europe, Asia or Australia |
Where a subprocessor is outside the European Economic Area, the transfer rests on the EU–US Data Privacy Framework or the Standard Contractual Clauses, as §11 of the DPA sets out.
2. Who is not on the list
- Your own tools. When KIFF sends an agent's call to a tool you connected, such as your payment or support system, that tool works for you, not for us. Its provider is your vendor.
- The public verifiable trail. Only summary hashes are published to it. It receives no personal data.
3. Changes
Before we add or replace a subprocessor that handles your personal data, we tell you at least thirty days ahead, and you may object, as §10 of the DPA sets out. We update this page within 30 days of any change.
Document version: v0.1.
Last updated: 23 October 2026.