Sub-processors
Last updated: 2026-09-22.
WikiFix is operated by Totem Dev. To provide the service, we use the third-party sub-processors listed below to process customer data on our behalf, each governed by their standard data-processing terms. Every vendor that offers an EU region is configured to it; the one that does not – TypeSafe – is marked below, and is reached only by installs that have not required EU residency. This page is the authoritative list referenced by our Privacy Policy and Security page.
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Amazon Web Services (AWS EMEA SARL) | Hosting, compute, storage, default AI + embedding inference (AWS Bedrock), and fallback email delivery (Amazon SES) | Confluence content under scan, derived embeddings, account identifiers, and the recipient address and scan-outcome details of any email we send | EU – Frankfurt (eu-central-1) |
| PostHog (PostHog Cloud EU) | Product analytics for the WikiFix app, and analytics for this website | From the app: metadata only – page titles, excerpts, and content are stripped by a code-enforced allow-list before any event leaves our systems, with two deliberate exceptions: your Atlassian site host, and the text of your own WikiFix search-box queries. From this website: page interactions and session replay, including what is typed into the contact form, and – if a contact-form submission fails – the name, work email, company, role and notes entered. Website analytics load only after you accept cookies | EU (eu.i.posthog.com) |
| Sentry (Sentry EU) | Error tracking | Metadata only; no PII (sendDefaultPii: false) | EU (de.sentry.io) |
| Langfuse | AI-quality monitoring (LLM observability) | Content-bearing: the full prompt we send to the AI model and the model’s response, which embed the page text under review | EU-resident, pinned via a fail-closed region guard |
| Anthropic PBC | AI model licensor (Claude). Claude Sonnet runs via AWS Bedrock in Frankfurt for installs that require EU residency; Anthropic’s own API is used only if you bring your own Anthropic key. Listed for transparency | None on the default path: per AWS Bedrock’s terms Anthropic has no access to page content. If you bring your own key, your prompts go to Anthropic’s API directly, under your own agreement with them. | US-incorporated; Bedrock inference stays in the EU, and the bring-your-own-key path is the one path that leaves our EU-region pin |
| Cohere | Embedding-model licensor (Embed v4, accessed via AWS Bedrock) – builds the index we search. Listed for transparency | None directly: per AWS Bedrock’s terms Cohere has no access to page content | US-incorporated; inference stays in the EU via Bedrock |
| Mistral AI | Text-embedding inference and AI review of page content, only when the Mistral embedding or scanning option is enabled for your instance | Content-bearing: the page text under review is sent to generate embedding vectors and, on the scanning path, as part of the AI prompt that reviews it | EU – France (api.mistral.ai), EU-resident by default; we pin the EU endpoint in code |
| TypeSafe (System One classifier) | Confirms that two passages are really talking about the same thing before WikiFix compares what they say – only for installs that have not required EU residency. Installs that require EU residency run this step on Claude Sonnet in Frankfurt instead | Content-bearing: the specific paragraphs being compared – not whole pages, never the whole space – with the page title, section heading and surrounding text of each, and the question they appear to answer | United States (api.typesafe.ai). Not reached by installs that require EU residency. Data Processing Addendum |
| Brevo (Sendinblue SAS) | Email delivery – the scan-completion notices and monitoring digests we send you | Recipient email address and scan-outcome details (finding counts, monitored space names, report links) – no page content | EU – France |
| Atlassian | Jira Service Desk – receives contact-form submissions from wikifix.ai so we can reply. This is about visitors to our website, not your Confluence content. | The name, work email, company, role, and free-text notes you type into the contact form | Atlassian Cloud |
Billing runs through the Atlassian Marketplace (“Paid via Atlassian”). Atlassian does not process your Confluence content on our behalf – WikiFix reads it through the Forge platform, and the only thing we hand Atlassian is a contact-form submission, as listed above. We don’t sell your data to anyone, ever.
Transfers outside the EU
One sub-processor on this list processes in the United States: TypeSafe, and only for installs that have not required EU residency. If your own review needs the transfer basis, TypeSafe’s Data Processing Addendum incorporates the EU Standard Contractual Clauses (Commission Decision 2021/914) — Module 2 for controller-to-processor transfers and Module 3 for processor-to-sub-processor transfers, which is the one that covers our use of them — together with the UK International Data Transfer Addendum (B1.0).
Two limits worth knowing before you rely on that. Their addendum does not contain a clause about training AI models on customer data; what restricts it is the purpose limitation, which permits processing only to provide the service under documented instructions. And it sets no fixed retention period, stating only that data is kept as long as necessary for the purpose. We link their terms rather than summarise them because they are TypeSafe’s to change, not ours.
If none of that is acceptable for your install, require European Union residency and this step runs on Claude Sonnet in Frankfurt instead — see Data residency for what that costs.
Changes to this list
We publish every addition or replacement here at least 10 business days before it takes effect, so you have time to object before a new sub-processor begins processing your data. You have 30 days from a posting to object on data-protection grounds — email security@wikifix.ai.
Follow our sub-processor feed to be notified. Every change is published to it at the same moment it appears here, so you don’t have to watch this page. Entries describe what we intend to do and when — if you object within the window, we won’t proceed on that basis without resolving it with you first.
No changes have been published yet — the list above is the current set of sub-processors.
Our Data Processing Agreement is published in full — it applies automatically when you accept our Terms, so there’s nothing to request or sign. If your procurement process needs a countersigned copy, ask us and we’ll send one.