Subprocessors
Last Updated: October 17, 2026
1. Scope
OXYGEN GTM Inc. uses subprocessors to provide hosting, identity, billing, analytics, AI, integration, enrichment, observability, and support functions for OXYGEN. Actual subprocessors vary based on the integrations, workflows, providers, and done-for-you services a customer enables.
2. Current Subprocessors
| Provider | Purpose |
|---|---|
| OVHcloud | Dedicated servers in France that OXYGEN operates itself: application, databases, file storage, and self-hosted analytics and monitoring |
| Hetzner Online | Encrypted backups, stored in Germany |
| Cloudflare | DNS, TLS, and routing and protection of web traffic |
| Clerk | Authentication, user identity, OAuth |
| Stripe | Billing and payment processing |
| Axiom | Operational logs and traces, until the move to self-hosted monitoring is complete |
| Vercel | Storage of publicly served files, such as images, until they move to OXYGEN's own servers |
| Fly.io | Outbound email proxy with static IP addresses for connected mailboxes |
| Anthropic and other AI model providers | AI model processing where configured or instructed, including speech-to-text for the optional dictation in the chat composer; the third-party provider that transcribes dictated audio may retain it under its own terms |
| Unipile | Email, LinkedIn, and messaging integration access where configured |
| Composio | CRM and productivity integration access where configured |
| HarvestAPI | Managed LinkedIn profile, company, post, engagement, and search data, collected and provided by HarvestAPI |
| Up2Data | Managed LinkedIn data, collected and provided by Up2Data, and LinkedIn post search and engagers on a customer's own Up2Data key |
| ScrapeLi | LinkedIn company-page follower audiences, ordered by Customer and fulfilled by ScrapeLi |
| Bright Data | LinkedIn post datasets where selected |
| Crustdata | Indexed company and people data, including LinkedIn-derived data, where selected |
| Enrichment and data providers | Contact, company, email, phone, and account enrichment where selected |
OXYGEN runs its product analytics, session recording, and MCP tool-call telemetry on a PostHog instance it operates itself on the servers above; that data is not sent to PostHog Inc. Section 13 of the Privacy Policy describes what it captures.
3. Provider-Specific Tools
OXYGEN also exposes customer-selected tool and enrichment providers. When Customer runs a provider tool, the provider receives the input necessary to perform that operation. Customer is responsible for selecting providers appropriate for its legal basis, jurisdictions, and data-protection obligations.
LinkedIn data is collected and provided by the named data suppliers above, not read through Customer's own LinkedIn account. Some of it, such as post engagement, activity, search results, and company-page followers, is visible on LinkedIn only to signed-in members, and a supplier may use signed-in sessions of its own to collect it. Customer is the controller of the personal data it chooses to retrieve and is responsible for its lawful basis and for informing the people concerned, including under GDPR Article 14 where it applies.
4. Notices & Objections
OXYGEN will update this page before a new subprocessor processes customer personal data, and before an existing subprocessor begins processing a materially new category of it. The August 15, 2026 update was of the second kind: PostHog already processed analytics and session recordings, and now also receives MCP tool-call arguments and results. The September 25, 2026 update names the data suppliers behind OXYGEN's managed LinkedIn data, which were previously listed under enrichment and data providers. The October 15, 2026 update reflects OXYGEN's move to its own servers: OVHcloud and Hetzner host the platform and its backups, Neon is no longer used, PostHog runs self-hosted, and Vercel and Fly.io keep only the narrower roles listed above. The October 17, 2026 update adds HarvestAPI, which takes over supplying OXYGEN's managed LinkedIn data from Up2Data; Up2Data keeps serving customers who use their own Up2Data key. Customers may object on reasonable data protection grounds within 30 days of the update by contacting [email protected].