Spec AI Subprocessors
Effective date: September 18, 2026
Document version: 2026-09-18-r03
This list identifies service providers that may process Customer Personal Data to provide or support Spec AI, including restricted operational recovery copies and optional features when enabled. Inclusion does not imply that a recurring backup schedule, customer recovery service, or optional plan OCR is active for every studio.
| Provider | Purpose | Data potentially processed | Processing location / transfer mechanism |
|---|---|---|---|
| Vercel Inc. | Application hosting, serverless execution, private file storage | Account, project, plan, catalog, review, and usage data | United States and provider infrastructure under applicable provider terms |
| Neon, Inc. or the applicable Neon contracting entity | Managed PostgreSQL database | Account, studio, project, extracted text, catalog, review, and billing metadata | Configured database region and provider infrastructure under applicable provider terms |
| OpenAI, L.L.C. or contracting affiliate | Product-data extraction, optional plan-image/text analysis, and AI help | Product-page text; plan images and extracted text; user-submitted AI help conversation text; generated output | United States/provider infrastructure; API business terms and applicable DPA/SCCs |
| Google LLC | Google OAuth authentication | Name, email, avatar, OAuth identifiers and limited authentication metadata | Global/provider infrastructure under applicable Google terms |
| Google LLC or the applicable Google Cloud contracting entity | Optional, user-triggered plan text and location recognition through Document AI OCR, when enabled | Uploaded PDF or image file, selected page numbers, extracted text, text locations and quality diagnostics | Document AI processor configured in the US region; applicable Google Cloud terms and data-processing terms |
| Google LLC or the applicable Google Cloud contracting entity | Restricted operational recovery-copy storage, backup execution, restoration, secret management, and monitoring | Encrypted copies of application database and private files, which can include account, studio, project, plan, specification, review, support, audit, and billing metadata; backup and access logs | Backup storage bucket configured in us-east4; other provider processing locations under applicable Google Cloud terms |
| Plus Five Five, Inc. (Resend) | Transactional invitation and review email | Sender, recipient, subject, message content, delivery metadata | Provider/subprocessor locations under Resend DPA |
| Jina AI or its applicable contracting entity | User-triggered public web-page retrieval | Requested public URL, retrieved page content, request metadata | Provider infrastructure under applicable provider terms |
Material Bank and manufacturers are data sources or linked third parties, not subprocessors acting on Spec AI's instructions. Their own terms and privacy practices apply when users leave Spec AI or when data is obtained from them.
Optional Google Maps service
Google LLC also provides optional address suggestions through Places API (New). This is a Google Maps service governed by the Google Maps terms and Google Privacy Policy, not a claim that Google acts as Spec AI's processor for all Maps service data. Address queries, optional country filters, short-lived session tokens and selected place identifiers are transmitted to Google. Plans, client names, account identity and the separate unit/suite field are not included. Manual address entry remains available. Processing occurs on Google's provider infrastructure under the applicable Google Maps terms.
Stripe is a planned provider and is not an active subprocessor until production billing is enabled. Planned, evaluated, or development-only providers are not included in the active table.
Changes
Spec AI may update this list as providers or processing change. When applicable data-protection law requires notice of an intended new subprocessor, Spec AI will provide notice before the relevant processing begins and allow an objection as required by law and the DPA. No fixed notice period, substitute provider, migration assistance, refund, or service-continuity commitment is provided by this page.
This list describes current processing and does not guarantee continued use, availability, location, functionality, or service levels of any provider. Provider locations and downstream subprocessors are governed by the linked provider terms and current vendor disclosures.
Questions or legally required notice requests may be sent to privacy@spec-ai.co.