Subprocessors.
The third parties that process customer data on Kita's behalf to deliver our services. Each is bound by written data protection terms. Last updated September 4, 2026.
Infrastructure and hosting
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud infrastructure hosting | Customer data, including documents, metadata and user information | Singapore (ap-southeast-1), Mexico (mx-central-1) |
| PlanetScale | Database (Southeast Asia region) | User accounts, document metadata, application data | United States |
| Vercel | Frontend hosting and CDN | No customer data | United States |
Document processing
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Reducto | Document parsing and extraction | Document content for processing | United States |
AI and machine learning
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Google (Gemini) | Document classification, extraction and validation | Document text content (not used for training) | United States |
| Anthropic (Claude) | Agent-based extraction | Document text content (not stored by Anthropic) | United States |
Communication
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Resend | Transactional email delivery | Email addresses, email content | United States |
Monitoring and analytics
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Sentry | Error monitoring | Error logs, with personal data scrubbed | United States |
| PostHog | Product analytics and masked session replay | Account identifiers, organization metadata, product events and masked page structure. Document content and form inputs are excluded. | United States |
Development
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| GitHub | Source code hosting and CI/CD | Source code only, no customer data | United States |
Where data is processed
Customer documents and application data are stored and processed in Southeast Asia (AWS ap-southeast-1) by default. Organizations that require Mexican data residency are processed and stored in AWS mx-central-1. Product analytics are stored separately, in the United States.
Changes to this list
We give customers 30 days' notice by email before adding or replacing a subprocessor, and update this page. Customers may object within those 30 days; we will work to address the concern, and where we cannot, termination may be available under your agreement.
Questions or objections: legal@kita.ai. See also our Data Processing Agreement.