Providers and sub-processors
Last checked 2026-11-03. This is a code-based inventory, not an assertion that every optional service is configured in production.
| Provider | Purpose and data | Who controls it |
| Paddle | Payment, tax, invoices, billing contact and transaction identifiers. Card numbers do not go to Switchboard. | Switchboard checkout; the receipt identifies the merchant entity. |
| Anthropic | Prompts and attachments sent through the optional Switchboard relay. Provider retention and use follow the applicable API terms, not a zero-retention promise from Switchboard. | Disable AIAllowed or RelayAllowed by MDM; individuals can turn AI off. |
| Apple | Optional private CloudKit sync; optional phone/watch approval transport and APNs; app notarization. Apple does not receive macro libraries merely because the app is notarized. | Customer Apple account and device settings; iCloudSyncAllowed disables library sync. |
| Customer-selected model provider | Direct BYOK prompts, attachments and API key. This is the customer's provider relationship. | Customer key and model settings; AIAllowed disables model use. |
| Server host and SMTP provider | Account database and operational mail. Actual provider identities, regions and retention must be confirmed before business service publication. | Deployment operator. Linode is planned, not represented as a live host. |
Custom HTTP macros, extensions and an external team library can contact providers chosen by the customer. Review the macro and its permissions; they are not a fixed Switchboard sub-processor list.
Changes
2026-11-03: initial inventory. Hosting and SMTP remain publication gates. Material new relay/account sub-processors require 30 days' advance notice to team owners under the published DPA.