> For the complete documentation index, see [llms.txt](https://docs.toucanai.cloud/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.toucanai.cloud/govern/security-model/third-party-subprocessors.md).

# Third-party subprocessors

{% hint style="info" %}
**Target Audience**: Security, legal, and procurement teams reviewing external data processing for Toucan AI.
{% endhint %}

### TL;DR

Toucan AI may rely on external providers **depending on your deployment and enabled features**. The table below summarizes common categories. Your contract and DPA define the authoritative subprocessor list for SaaS.

***

### When to use this

Use this page for privacy assessments, vendor reviews, and understanding which external parties may process data when you use Toucan AI.

***

### Subprocessor overview

| Provider category         | Purpose                                                    | Data that may be processed                                                        | When used                    |
| ------------------------- | ---------------------------------------------------------- | --------------------------------------------------------------------------------- | ---------------------------- |
| **LLM provider**          | AI inference (chat, chart generation, metadata enrichment) | Prompts, conversation context, query-related context                              | When AI features are enabled |
| **Product analytics**     | Usage metrics, product improvement                         | Events, performance data; during beta, may include conversation-related telemetry | When analytics is enabled    |
| **AI tracing**            | Debug and quality of AI workflows                          | Execution traces (may include prompts/outputs)                                    | When tracing is enabled      |
| **Billing**               | Subscriptions and payments                                 | Organization and billing identifiers                                              | When billing is enabled      |
| **CRM**                   | Customer success and onboarding                            | Account email, organization profile fields                                        | When CRM sync is enabled     |
| **OAuth providers**       | Sign-in with Google, GitHub, LinkedIn                      | OAuth tokens and profile data                                                     | When social login is enabled |
| **Email (SMTP)**          | Transactional email                                        | Email addresses, message content                                                  | When email is sent           |
| **Notifications (Slack)** | Internal alerts (e.g. signups, feedback)                   | Notification payloads                                                             | When webhooks are configured |

#### LLM providers

Toucan AI sends data to an LLM provider to run AI features. The default integration path uses **Anthropic** (Claude). Organizations can select a different provider and model from **Settings → AI behavior** (see [Choose your AI provider and model](/govern/ai-control-and-optimization/select-your-ai-provider.md)); the provider you select is the one that receives your prompts and context.

**Typical data sent**: user messages, system instructions, database metadata snippets, and context needed to answer or build a chart.

#### Analytics & tracing

* **Product analytics** may record feature usage and AI-related events.
* **Tracing tools** may record steps of AI execution for debugging and quality.

#### Business & identity services

* **Billing** processes subscription data when billing is active.
* **CRM** may sync signup and profile fields when enabled.
* **OAuth** providers handle authentication when users sign in with a social account.

***

### Your responsibilities

* Review the subprocessor list in your **DPA** or trust documentation for the authoritative legal register.
* Disable or configure optional integrations according to your policy
* Minimize personal data in tokens and AI context before it reaches any external provider.

***

### Related pages

* [PII & personal data](/govern/security-model/pii-and-personal-data.md)
* [AI assistant data handling](/govern/security-model/ai-assistant-data-handling.md)
* [Data storage & retention](/govern/security-model/data-storage-and-retention.md)