Sub-processors
Last updated: July 14, 2026
To operate Zest (the "Service") we rely on a small number of third-party providers that may process customer data on our behalf. They are listed below, together with what each one is used for. Every sub-processor receives only the data necessary to perform its function and is bound by contractual confidentiality and security obligations. We do not sell customer data, and no customer data is used to train AI models.
Sub-processors and the Zest Slack app
Only Cloudflare and Supabase process data that originates from a customer's Slack workspace — that is, the workspace ID and name, the bot user ID, the OAuth bot token (held in encrypted secret storage), the channel names and IDs shown in the setup channel picker, the delivery channel selected by the workspace owner, and delivery metadata about the messages we posted.
No other sub-processor receives any Slack data. The Zest Slack app requests no history-type scopes, so it never accesses Slack message content, files, user profiles, or membership data — none of it exists in the Service to be shared. In particular, no Slack data is ever sent to an LLM: the summaries and reports the app posts are generated from your own coding activity collected by Zest, and are delivered to Slack as finished text.
Current sub-processors
The full list of providers we use to operate Zest, and whether each one processes data originating from Slack.
| Sub-processor | Purpose | Processes Slack data? |
|---|---|---|
| Cloudflare | Application hosting and edge compute (the Zest web app and APIs run here). | Yes |
| Supabase (hosted on AWS) | Managed PostgreSQL database, authentication, and encrypted secret storage (Supabase Vault). | Yes |
| OpenRouter | LLM API gateway used to generate summaries and reports from your coding activity. Vercel AI Gateway serves as a fallback route. | No |
| Anthropic, OpenAI | Model providers reached through the gateways above. Customer data is not used to train their models. | No |
| Resend | Transactional email (account, report, and notification emails). | No |
| PostHog | Product analytics — aggregated usage events used to improve the Service. | No |
| Stripe | Billing and payment processing. | No |
Changes to this list
We keep this page current. If we engage a new sub-processor that processes customer data, we update this list. To be notified of changes, or to ask a question about any provider above, email hi@winding.ai.
Related
See our Privacy Policy for how we collect, retain, and delete data, our Terms, and Contact if you need help.