Subprocessors
Subprocessors are third parties that may process data on Align's behalf in the Align-hosted cloud offering. Self-hosted deployments run in your own infrastructure and can avoid most of these entirely (see the notes column).
| Subprocessor | Purpose | Data processed | Notes |
|---|---|---|---|
| Amazon Web Services (AWS) | Hosting, database, storage, cache | All tenant data (encrypted at rest) | Region configurable. Self-host runs on your own infra. |
| Anthropic | Default LLM for decision extraction & analysis | Source text after PII redaction | Default provider. Disable by self-hosting with a local LLM. |
| OpenAI | Optional/fallback LLM | Source text after PII redaction | Only if configured as provider/fallback. |
| Grafana Cloud | Infrastructure telemetry (OpenTelemetry) | Metrics/traces, no customer decision content (redacted in span processor) | Opt-in; OTel is off by default. |
| PostHog | Product analytics | Usage events / metadata, not decision content | Cloud app, and anonymous pings from local-only CLI installs (no account, no decision content): the CLI sends two anonymous counts by default (install, setup completed); usage only with your consent; align telemetry off or DO_NOT_TRACK=1 stops all of it. Every field is listed in the CLI's telemetry page. |
| Resend | Transactional email (magic-link sign-in, verification codes) | Email address, and the credential itself (the magic link / OTP code) | Align-hosted cloud only. Self-host sends no email through Align's infrastructure. |
| Cloudflare | DNS, TLS certificate issuance, and the signup-verification Worker for self-service SaaS signup | Domain/DNS records; for signup, the email address being verified | Align-hosted cloud only. |
Corrected 2026-09-06: this list previously omitted Resend and Cloudflare. Resend delivers
sign-in and verification emails (services/gateway/src/email/emailService.ts) and is named in
the order form's Schedule 1; a subprocessor list that disagreed with the contract schedule was
a procurement problem, not a copy nit.
Data-handling notes
- PII redaction before LLM egress. Before any text is sent to an LLM
subprocessor, Align redacts emails, phone numbers, SSNs, IP addresses,
and API keys, and runs Microsoft Presidio's
PERSONmodel to catch names (Presidio, on by default). Conversational endpoints route through the redaction chokepoint inservices/brain/app/llm_client.py. Presidio's name detection is a probabilistic NLP model, not a guaranteed match on every name the way a regex-matched SSN or email is. (Corrected 2026-09-06: this bullet previously listed "names" alongside the pattern-matched categories as though redaction removes them with the same certainty. It doesn't - PERSON detection can miss a name. An earlier draft of this correction also said redaction "does not currently run on every conversational endpoint," which was true before the ALI-304 chokepoint and is no longer true - caught in review before merge.) - Zero cloud LLM egress option. Point Align at a local LLM (Ollama/vLLM) to keep all inference in your environment.
- Telemetry excludes customer content. When OpenTelemetry is enabled, SQL parameters and HTTP request/response bodies are scrubbed before export.
- Product telemetry is on by default, and stays in your database. Usage
events are written to
telemetry_eventsin your own Postgres. SetTELEMETRY_ENABLED=falseto switch it off entirely. It is not opt-in, and we would rather say so than claim otherwise. - Product telemetry avoids customer-authored content, and PostHog egress is allowlisted. Events are written to
telemetry_eventsin your Postgres; a search records its result count and the length of the query, never the query. Some events may include limited operational strings or model-generated fields in your database, but where PostHog is configured an explicit allowlist of property keys is applied at every egress point so only deliberately-published identifiers/enums/counts are sent - including the anonymous local-CLI ping, which carries no account or tenant to begin with. - Billing. Payment processing (e.g. Stripe) applies only if/when self-serve billing is enabled for your account; Pro accounts onboarded ahead of published retail pricing have no billing subprocessor.
This list is reviewed as the stack evolves. Material changes to subprocessors will be reflected here.