Legal
Subprocessors
Last updated October 19, 2026
These subprocessors may process Customer Personal Data when Customer uses the hosted MergeHarbor service. Model providers process data only when Customer's routing and data residency settings permit them to. Where Customer supplies its own model-provider accounts, that provider acts under Customer's own agreement with it and is not MergeHarbor's subprocessor.
| Subprocessor | Purpose | Location |
|---|---|---|
| Amazon Web Services, Inc. | Hosting, storage, and encrypted backups of the MergeHarbor service | Australia (AWS Asia Pacific (Sydney) region, ap-southeast-2) |
| Anthropic, PBC | AI model inference for reviews | United States, or other regions where offered |
| OpenAI, L.L.C. | AI model inference for reviews, and code embeddings for search | United States, or other regions where offered |
| Twilio Inc. (SendGrid) | Sign-in links, invitations, and notification emails | United States |
| GitHub, Inc. | Code-host integration (the MergeHarbor GitHub App) for organizations that connect GitHub, and GitHub sign-in | United States |
| Cloudflare, Inc. | DNS hosting and domain registration only. Cloudflare does not proxy service traffic or receive Customer Data | Global DNS network |
This list is Annex III of our Data Processing Addendum. We give at least 30 days' notice before a new subprocessor processes Customer Personal Data, as described in section 6 of the DPA. To be notified of changes, emailprivacy@mergeharbor.com.