Subprocessors
Every third party that receives customer data, with purpose, data categories and region — built from what the code actually calls.
Effective date: 2026-09-25. Operator: Kotoba Labs Inc., a Delaware corporation (United States).
Draft. Published 2026-09-25 and pending review by counsel. It describes how the service works today and may change; the date above changes with every revision. Questions: legal@mithril.fund.
This list is built from what the service's code and configuration actually call, not from a vendor inventory. Each row names where in the code the call is made. A region is “Not specified” wherever nothing in the code or configuration selects one.
| Provider | Purpose | Data categories | Location / region | Evidence (repository cloud-kotoba/app-kotoba-cloud) |
|---|---|---|---|---|
| Cloudflare, Inc. | Hosting and edge network for every mithril.fund host: Workers, static assets, Durable Objects (accounts, billing ledger, research records, request ledger), R2 object storage, Workers Workflows, Workers observability logs, Email Routing for @mithril.fund addresses, and Cloudflare Email Service, which sends the sign-in links from no-reply@mithril.fund. | All service data: account identifiers and linked sign-in identities (provider, provider account id, email, display name), request metadata, prompts in transit, billing ledger, verification status, logs, inbound email to @mithril.fund, the email address and link of each sign-in email. | Not specified — Cloudflare's global network; no jurisdiction, location hint or placement is set in config. |
wrangler.jsonc:8-13 (assets)wrangler.jsonc:202-220 (r2_buckets)wrangler.jsonc:221-240 (durable_objects)wrangler.jsonc:261-263 (observability)wrangler.research.jsonc:18-50 (durable_objects, workflows)Email Routing rules, zone mithril.fund (Cloudflare API)cloud-kotoba/kotobase-control-plane authn/src/authn/email_link.cljk:32-33, 79 (send_email binding AUTHN_EMAIL)cloud-kotoba/kotobase-control-plane authn/src/authn/account.cljk:353-360 (identity rows in a Durable Object)
|
| Stripe, Inc. | Card verification ($0 setup-mode Checkout), payments, subscriptions, credit purchases, automatic recharge, customer portal; optional document verification (Stripe Identity). | Principal identifier (in Stripe metadata), card and payment details (entered at Stripe; never received by Mithril), billing email and address as entered at Stripe, identity documents and face images if you choose Stripe Identity. | Not specified in code. |
src/app_kotoba_cloud/research_authority.cljk:396 (api.stripe.com)src/app_kotoba_cloud/research_authority.cljk:452 (/v1/customers)src/app_kotoba_cloud/research_authority.cljk:565 (/v1/checkout/sessions, mode=setup)src/app_kotoba_cloud/billing_account.cljk:130-197 (Checkout)src/app_kotoba_cloud/billing_gateway.cljk:135-136 (webhook events)
|
| OpenRouter, Inc. | Shared inference route for research jobs and the support chat. OpenRouter forwards each request to an upstream model provider; which upstream serves a request is not fixed in code. | Prompt and conversation content of research jobs; support-chat messages with knowledge-base text. | Not specified in code. |
src/app_kotoba_cloud/blue_route.cljk:13 (openrouter.ai/api/v1/chat/completions)wrangler.jsonc:325 (BLUE_ROUTE_CONFIGURED)src/app_kotoba_cloud/support_authority.cljk:49-53
|
| Hugging Face, Inc. (Inference Endpoints) | Dedicated inference routes, and the separate screening model that checks requests against the Acceptable Use Policy when it is hosted on this provider. | Prompt and conversation content; for screening, the last 12,000 characters of the request's user turns. | Not specified in code (the endpoint URLs are deployment secrets). |
src/app_kotoba_cloud/red_route.cljk:26 (.endpoints.huggingface.cloud)src/app_kotoba_cloud/guardrail_screen.cljk:232
|
| Modal Labs, Inc. | Dedicated inference routes (including the screening model when hosted on this provider); the hosted agent sandbox. | Prompt and conversation content; for screening, the last 12,000 characters of user turns; the principal identifier and prompt sent to the sandbox. | Not specified in code. |
src/app_kotoba_cloud/red_route.cljk:26 (.modal.run)wrangler.jsonc:288 (HERMES_SANDBOX_GATEWAY_URL)src/app_kotoba_cloud/sandbox_gateway.cljk:174
|
| Resend | Transactional email: confirmation codes for the optional notification address and account notices; inbound mail for support@mithril.fund. | Your notification email address, message subject and body (for example an 8-character confirmation code). | Not specified in code. |
src/app_kotoba_cloud/research_authority.cljk:3859-3873 (RESEND_API_KEY, mailer :resend)wrangler.research.jsonc:101 (CONTACT_MAIL_FROM)Email Routing rule support@mithril.fund (Cloudflare API)
|
| Google LLC (Gmail) | The operator mailbox that receives security@, privacy@ and legal@ mail forwarded by Cloudflare Email Routing. | The content of messages you send to those addresses. | Not specified. |
Email Routing rules security@ / privacy@ / legal@mithril.fund (Cloudflare API, read 2026-09-25)
|
| Base public RPC providers (mainnet.base.org, PublicNode, 1RPC, meowRPC) | Reading public Base chain state when you connect a wallet. | A wallet address (public blockchain data) and the query about it. | Not specified. |
src/app_kotoba_cloud/wallets.cljk:102-105
|
Sign-in providers you choose
Google and GitHub are not our subprocessors: you choose them to sign in at auth.mithril.fund, and they process your account under their own terms. What we receive from them:
| Provider | Purpose | Data we receive | Evidence |
|---|---|---|---|
| Google LLC (Sign in with Google) | Sign-in with your Google account, when you choose it. Scopes openid, email, profile. | Google account id (sub), email, email-verified flag, name, profile-picture URL — received once per sign-in; the account keeps provider, account id, email and display name. |
cloud-kotoba/kotobase-control-plane authn/src/authn/link.cljk:190-232authn/src/authn/org_sso.cljk:334 (scope openid email profile)
|
| GitHub, Inc. (Sign in with GitHub) | Sign-in with your GitHub account, when you choose it. | GitHub user id, login, name, avatar URL, primary verified email — received once per sign-in; the account keeps provider, account id, email and display name. |
cloud-kotoba/kotobase-control-plane authn/src/authn/link.cljk:202-203 (api.github.com/user, /user/emails), 237-250
|
Third-party scripts in your browser
| Provider | Purpose | Evidence |
|---|---|---|
| Freebuff | Advertising conversion measurement. The tag sets a `bfcid` cookie (30 days) and reports one conversion only when you arrived by clicking a Freebuff ad (a `bfcid` in the landing URL); otherwise it does nothing. |
src/app_kotoba_cloud/browser.cljk:17, 59-73src/app_kotoba_cloud/csp.cljk:15
|
Not used
- Backblaze B2 — not referenced by the Workers.
- Self (self.xyz) and api.murakumo.cloud inference — present only in test/adapter code with no production caller.
Data residency
Not pinned: no storage or processing region is selected in code or configuration. Service data is processed on Cloudflare's global network and by the providers on /legal/subprocessors/, whose regions are not specified; data may be processed in the United States and other countries.
- No Cloudflare jurisdiction restriction (for example an EU jurisdiction for R2 or Durable Objects), location hint or placement is configured.
- Inference and screening providers are reached by URL; their regions are chosen in the providers' own consoles and are not recorded in the code.
- Customers who need a pinned region should ask at legal@mithril.fund before sending regulated data; we will not describe a region as pinned until the configuration pins it.
Changes
New subprocessors are announced on this page at least 30 days before they receive Customer Personal Data (see the DPA). Questions: privacy@mithril.fund.