Last updated: October 8, 2026
Inferbase uses the following third parties to provide the Service. Each receives only the data its function needs. Organizations covered by our DPA are notified at least 30 days before we add or replace a subprocessor that processes customer content, and may object as the DPA describes.
Infrastructure
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Railway Corporation | hosts the API, database, cache and our classifier service | all Service data | the United States (US West) |
| Vercel Inc. | hosts the website and dashboard; cookieless web analytics | website requests, page analytics | global edge; United States |
| GitHub, Inc. (Microsoft) | stores encrypted weekly database backups (90 days) | encrypted backups | United States |
Model providers (managed inference)
Used only for requests served on Inferbase's own accounts. Requests served on a customer's own provider key or cloud account go to that customer's provider under the customer's agreement and are not listed here.
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Together Computer, Inc. (Together AI) | serves models | request content for the requests it serves | United States |
| DeepInfra, Inc. | serves models; independent task labels for routing quality checks (Privacy Policy section 3) | request content for the requests it serves; the latest user message of stored requests | United States |
| Novita AI | serves models | request content for the requests it serves | United States and other locations, per its privacy policy |
A provider may list a closed-weight model it does not run itself and forward requests for it to the model's creator under the provider's own agreement with them (DeepInfra marks such listings "Partner"; Alibaba's closed Qwen models are an example). Request content for such a model reaches that creator through the provider. We do not use a provider's listing where the provider requires a separate data-sharing opt-in for it.
When a guardrail policy enables the unsafe-content check, the checked text is sent to a guard model served by one of the providers above.
Operations
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Resend | transactional and notification email | email address, name, message content | United States |
| Functional Software, Inc. (Sentry) | error tracking | technical error context (stack traces, request paths); organization ids and, on sign-up abuse alerts, IP addresses; default personal data collection is off | United States |
| Cloudflare, Inc. | bot protection on sign-up and sign-in (Turnstile) | browser signals, IP address | global |
| ipapi.is | classifies a sign-up's IP address (hosting, proxy, VPN, Tor) | IP address of the sign-up request | Germany |
| Google LLC | sign in with Google (optional) | Google account identifier, email, name | United States |
Website analytics
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Google LLC (Google Analytics 4) | website analytics (unless turned off) | page views, device and approximate location data | United States |
| Microsoft Corporation (Clarity) | website heatmaps and session replay (unless turned off) | interaction data, masked form input | United States |
Payments (not yet live)
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| the provider named at checkout | subscriptions, credit purchases, invoices, tax | billing contact, amounts, payment status (card data stays with them) | named when payments open |