TopoTopic Legal
Primary service providers used to operate TopoTopic.
Last updated 2026-08-25.
TopoTopic uses third-party service providers ("subprocessors") to operate the Service. This page lists primary providers that may process customer content or personal information on our behalf.
This schedule reflects the primary reachable processors in the shipped product as of the last-updated date below. Some providers are only used when you explicitly invoke the related feature or source integration, and some are feature-flagged and may be inactive in your configuration.
This list may change over time as we add or replace providers. For broader information, see our Privacy Policy and Legal Notice / Imprint.
| Provider | Purpose | Data categories | Region | Transfer safeguard |
|---|---|---|---|---|
| Amazon Web Services (AWS) | Hosting, databases, storage, background workers, and transactional email delivery through AWS SES | Account data, workspace content, media files, service metadata, and account lifecycle emails | EU (Ireland, eu-west-1) | Primary infrastructure in the EU; encrypted in transit and at rest |
| OpenAI | Language and assistant features, summaries, keyword extraction, embeddings, learning content, live translation, voice and call workflows, some transcription paths, text-to-speech, image understanding and generation, and Newsstand public-web research | Audio, text, document excerpts, URLs, public-safe topic/query text, limited metadata, provider session identifiers needed for requested outputs, and, for opt-in voice recognition, speaker reference clips with the display names used to label matched speakers | USA or configured provider region | EU-US Data Privacy Framework (certified participant) and EU Standard Contractual Clauses |
| AssemblyAI (speech-to-text API) | Live speech-to-text, uploaded-file transcription, speaker labeling, and transcript analysis for some session features | Audio, timing metadata, and transcript text for transcript analysis features | USA for uploaded-file transcription and analysis paths; EU endpoints for live transcription of EU visitors where regional routing information is available | EU Standard Contractual Clauses |
| Google (Sign-In, Calendar, YouTube Data API, Gemini models) | Sign-in, calendar actions you approve, YouTube import, and document understanding and text recognition for document and image processing (including the Focus reading flow and image uploads) | Account identifiers, calendar-action payloads, public source metadata and captions, and document or image content needed for the requested flow | USA or configured provider region | EU-US Data Privacy Framework (certified participant) |
| Google Analytics (GA4) | Optional consent-gated analytics | Usage telemetry when analytics consent is enabled | USA or configured provider region | EU-US Data Privacy Framework (certified participant) |
| Anthropic | Alternate assistant chat provider that can serve chat responses where enabled; current product flows default to OpenAI | Chat message text and limited metadata for the requested response | USA or configured provider region | EU Standard Contractual Clauses (incorporated in the provider data processing addendum) |
| Supadata (Dumpling Software UG) | URL, social/video, and web-source transcript or scrape retrieval for link imports, and the primary caption provider for YouTube imports | Source URLs, public or user-authorized page and media metadata, transcript or caption text, and job metadata needed for requested imports | EU-established provider (Germany) | EU-established provider; processing per provider terms |
| PostHog | Optional consent-gated product analytics, limited masked session replay on selected pages, and limited operational product events | Usage telemetry, event properties, analytics identifiers, and, for signed-in users with analytics enabled, account profile fields such as email and display name | USA (PostHog US Cloud); requests routed through our own domain | EU-US Data Privacy Framework (certified participant) and EU Standard Contractual Clauses |
| Sentry | Operational error monitoring and reliability diagnostics | Error events, runtime metadata, scrubbed identifiers, and stack traces | EU (ingestion in Germany) | EU-region data residency |
| Stripe Billing | Subscription billing, invoices, and hosted billing portal, when paid plans are enabled | Billing identifiers, subscription metadata, invoices, and payment metadata | USA or configured provider region | EU-US Data Privacy Framework (certified participant) and EU Standard Contractual Clauses |
| Twilio | External messaging channels (WhatsApp) where enabled | Phone numbers, message content, media references, and delivery metadata for the channels you connect; voice notes received on connected channels are transcribed through OpenAI | USA or configured provider region | EU-US Data Privacy Framework (certified participant), with Binding Corporate Rules and EU Standard Contractual Clauses as fallback |
| Slack (Salesforce) | Operational alerting to the operator about service health and cost anomalies | Technical alert event data, which can include internal identifiers | USA or configured provider region | EU-US Data Privacy Framework (certified participant, Salesforce) |
Subprocessors are authorized to process Customer Content only as needed to provide contracted services to TopoTopic.
Current product routing note: OpenAI carries the main assistant, analysis, live-translation, and voice-backed flows, including Newsstand public-web research built from public-safe topic and query text. Google provides sign-in, calendar actions, YouTube import, and document understanding and text recognition for document and image processing. Anthropic is an available alternate chat provider; current product flows default to OpenAI.
External websites, connected accounts, and source services you choose to import from may process your request under their own terms and are not always TopoTopic subprocessors.
Our primary infrastructure (AWS) is located in the EU (Ireland, eu-west-1). Where a provider processes personal data in the United States or another country outside the European Economic Area, we rely on the safeguards of Chapter V GDPR:
You can request a copy of the relevant safeguards via support@topotopic.com.
Questions about subprocessors can be directed to support@topotopic.com.
Last updated 2026-08-25.
We use cookies to keep you signed in. Optional analytics are off unless you allow them. We do not sell personal information or share it for cross-context behavioral advertising. Privacy policy • Cookie policy