Switchboard · Legal

AI providers and sub-processors

Every company that handles Switchboard data on our behalf, what it does with it, and which country it is in. Most services bury this. It is the whole argument for buying from a router, so we publish it.

Version 1.0In force from 18 September 2026Protocol 42 Inc.

01AI providers

When you send a message, it goes to one of these companies to be answered. Which one depends on what you asked, which tier you are using and what is available at that moment.

Companies that process the content of your messages.
CompanyWhat it doesWhereNotes
OpenAIText models, image generation, voice transcriptionUnited StatesAPI content is not used to train OpenAI models by default. Also handles dictation: the clip is transcribed and the audio is not retained by us.
AnthropicText models, including the most capable tierUnited StatesCommercial API inputs and outputs are not used to train Anthropic models by default.
GoogleText modelsUnited StatesUsed on a billing-enabled project, where the paid-tier data terms apply rather than the free-tier terms.
DeepSeekLow-cost text modelsPeople's Republic of ChinaWhere DeepSeek's own API is used, the request is processed in the PRC under PRC law. Projects can be restricted so that work never reaches it; the same open-weight models are also reachable through North American hosts.
OpenRouterRouting to further model providersUnited StatesAn aggregator. See section 2 — it is the one entry on this list that introduces companies not named here.

We turn on every setting each provider offers that prevents your content from being retained or used for training, and we choose paid API tiers rather than free ones, because the data terms differ.

02Routing through an aggregator

OpenRouter is not a model builder. It is a router that forwards a request to whichever company hosts the model, which means a request routed through it can reach a hosting company that is not named in the table above.

We constrain that in two ways:

  • every request we send through OpenRouter is marked to refuse any host that retains or trains on prompts, so only hosts that have agreed not to will serve it; and
  • a project can be restricted to a named set of providers. That restriction is enforced on our servers before the request leaves, not in the browser, and an attempt to route outside it is refused and recorded.

Treat anything routed this way as non-confidential by default.

Model origins in this market include laboratories in the United States, Europe and the People’s Republic of China, even where the hosting is elsewhere. If the work is confidential, restrict the project to named providers and choose the ones whose terms you have read.

03Infrastructure and business services

Companies that hold or move data in order to run the service.
CompanyWhat it doesWhereNotes
SupabaseDatabase, authentication and file storageUnited StatesHolds your account, chats, files and usage records. Encrypted at rest; each customer's rows are isolated by the database itself.
RailwayHosting for the Switchboard APIUnited StatesRuns the service that receives your request and routes it. Nothing is stored there.
VercelHosting for the website and the appUnited StatesServes the pages. Request logs only; no conversation content.
StripePayments and subscription billingUnited StatesTakes the payment. Your full card number goes to Stripe and never to us — we receive the last four digits, the brand and whether the charge succeeded.
ResendSending emailUnited StatesDelivers sign-in links, receipts and notices. Sees your email address and the contents of those messages.

04What is actually sent

To an AI provider we send:

  • your message, and the earlier messages in that conversation that give it context;
  • any file, image or transcription you attached, as text or as an image;
  • project knowledge you have added, when the project is in use; and
  • the results of a connected tool run, when a model asked for one.

We do not send your name, your email address, your billing details or your account identifier.

Voice is a special case: a dictation recording is streamed straight to the transcription provider and never written to our disks or our database. Only the words come back, and only you decide whether to send them.

05What you can control

  • Restrict a project to named providers. Set it in project settings; it is enforced server-side for every message in that project.
  • Delete a conversation. That removes the content from our systems. It cannot reach back into a provider’s systems, which is one more reason we prefer providers that do not retain.
  • Do not connect a tool you do not want reached. A connection is read-only until you change it.
  • Export and leave. Any chat can be exported, and closing your account deletes your content on the schedule in the Privacy Policy.

06Changes to this list

This list changes as models and providers change. We update it when we add or remove a provider, and the version and date are at the top of this page. A change to the list is not by itself a change to the Terms of Service, but if you want to be told when it happens, write to privacy@switchboardai.ca and we will add you to the notice list.

How to reach us

Protocol 42 Inc. is a corporation incorporated in Ontario, Canada, and operates Switchboard at https://www.switchboardai.ca.

All legal documentsHome