Subprocessors
Last updated: September 2026
This English version is a convenience translation. The German-language version is the legally binding version; in case of any discrepancy, the German version prevails.
This page lists the current subprocessors used for SpecMCP. A subprocessor is a third party that may process personal data on our behalf in connection with providing the service.
This list reflects our current production stack and may be updated from time to time.
Current Subprocessors
Fly.io, Inc.
- Purpose: application hosting and delivery
- Data location / notes: EU deployment region in use for service hosting; vendor entity based in the USA
Neon (Databricks, Inc.)
- Purpose: managed Postgres and application data storage
- Data location / notes: EU-hosted database deployment (Frankfurt) in use; vendor entity based in the USA (EU-US Data Privacy Framework)
Resend Inc.
- Purpose: transactional email delivery
- Data location / notes: used for verification, invitation, and operational emails
Stripe Inc.
- Purpose: billing and subscription management
- Data location / notes: used for payment processing, invoices, and subscription administration
Google LLC / Google OAuth services
- Purpose: authentication provider
- Data location / notes: used only when users choose Google sign-in
GitHub, Inc.
- Purpose: authentication provider; and, for workspaces that install the SpecMCP GitHub App, the source of pull-request and repository data and the destination for review results
- Data location / notes: used when a user chooses GitHub sign-in or the customer installs the GitHub App; App access is limited to the repositories the customer selects
OpenAI, L.L.C.
- Purpose: large language model analysis and text embeddings for the optional GitHub regulatory-impact bot
- Data location / notes: used only for workspaces that connect the GitHub integration; redacted pull-request content and repository files read during analysis are sent via the OpenAI API; vendor entity based in the USA (EEA entity: OpenAI Ireland Ltd); transfers under the EU-US Data Privacy Framework and standard contractual clauses; OpenAI does not use API data to train its models
Notes on AI and Model Providers
SpecMCP does not use customer data to train our own models, and our model providers do not use data submitted through the service to train theirs.
The core MCP and web-application service does not forward customer prompts to third-party model providers. The optional GitHub regulatory-impact bot is the exception: when a customer installs the SpecMCP GitHub App, redacted pull-request content (diffs, titles, descriptions, and repository files the analysis reads) is sent to OpenAI via its API to produce the regulatory-impact result. Obvious secrets are removed before transmission, and this processing occurs only for workspaces that connect the GitHub integration.
Contact
If you need notice of changes to subprocessors in connection with a commercial agreement, please contact billing@specmcp.com.