22 Subprocessors
Last updated: 30 September 2026.
These are the companies that help DSBC Group, LLC run 22 and may touch customer data. Each is bound by its own data processing terms. We give customers 30 days' notice before adding or replacing a subprocessor (see our Data Processing Agreement, section 6). To get notices, email privacy@22floor.com.
Apps a customer connects (Gmail, Outlook, Shopify, Meta, Google Ads, Zoho Desk, Zendesk, Amazon and others) are not on this list: they are the customer's own providers, under the customer's own agreements with them. 22 reaches them on the customer's behalf.
Subprocessors (touch customer data)
| Vendor | What it does for 22 | Data it touches | Location | Its terms |
|---|---|---|---|---|
| Cloudflare, Inc. | Hosts the app and server functions (Pages, Workers); stores all 22 data in its D1 database; network security | All data 22 stores: accounts, company data, memory, knowledge, drafts, sealed connection keys, logs | Global edge network; D1 database in Cloudflare's Eastern Europe location (not locked to the EU) | Data Processing Addendum · Privacy Policy |
| Anthropic, PBC | The AI (Claude) behind Atlas, the agents, meetings, drafts, memory, sorting and learning | What each AI request contains: the question, relevant rules, memory and knowledge, and what the connected tools returned (can include end-customer names, emails, messages, orders) | United States | Data Processing Addendum · Commercial Terms · Retention. No training on API data; inputs and outputs deleted within 30 days by default (up to 2 years only for content flagged under its Usage Policy). |
| OpenAI, L.L.C. | Turns speech into text; live voice calls; text-to-speech; backup answers when Claude is unavailable (memory, sorting, drafts, the demo); ad images (Creative feature, switched off today) | Owner's voice (audio, not stored by 22); text of replies to be spoken; for backups, the same content as an AI request | United States | Data Processing Addendum · Enterprise privacy. No training on API data by default; may keep API data up to 30 days for abuse monitoring. [To confirm before publishing: DPA executed for 22's account.] |
| ElevenLabs (Eleven Labs, Inc.) | Speaks Atlas's replies (text-to-speech) | Text of Atlas's replies, which can include business and end-customer details | United States (processing may occur in other regions under its DPA) | Data Processing Addendum · Privacy Policy · Data use for training. Trains on data by default below Enterprise; 22 switches that setting off. [To confirm before publishing: setting is off.] |
| Composio (Sampark Inc. d/b/a Composio) | Connects 22 to the customer's apps (Gmail, Outlook, Meta Ads, Google Ads, Zoho Desk, Zendesk, Facebook, Instagram, QuickBooks, Xero, Stripe and more); holds the OAuth tokens and API keys the customer grants; runs the actions 22 asks for | Tokens and keys for connected apps; everything read from or sent to those apps through it (mail, tickets, orders, ads, comments) | United States | Data Processing Addendum · Privacy Policy · Trust Center |
| Resend (Plus Five Five, Inc.) (planned; only if enabled) | Sends password-reset and account emails | Account email address, message content | United States | Data Processing Addendum · Terms |
Other vendors (no customer data, or 22's own data only)
| Vendor | What it does | Data it touches | Location | Its terms |
|---|---|---|---|---|
| GitHub, Inc. | Stores 22's source code | Source code only. No customer data. | United States | Data Protection Agreement |
| Zoho Corporation | 22's own support mailbox (support@22floor.com and similar) | Whatever people write to our support address (we are controller) | Per Zoho account data center | GDPR and DPA (DPA by request to legal@zohocorp.com) · Privacy Policy |
| Frankfurter (frankfurter.app, European Central Bank rates) | Currency exchange rates for the P&L | A currency pair and a date. No personal data. | EU (open-source service) | frankfurter.dev |
| Google (Google Fonts) | Serves the fonts on our pages | Visitor's IP address and browser details when a page loads | Global | Google Privacy Policy |
Changes
| Date | Change |
|---|---|
| 27 Sep 2026 | First published list. |
Sources
Each vendor's own terms, linked in the tables above (checked 27 September 2026). Cloudflare D1 location: Cloudflare API for database k22 (running in "EEUR", no jurisdiction set; checked 27 September 2026). Cloudflare D1 encryption: D1 data security.