Sub-processors
Who helps us run the Service.
These are the sub-processors Management OS uses to operate the Service. Each is contractually required to protect personal information and to use it only as we instruct. This page is maintained; material changes are communicated to customers under the terms of our Privacy Policy and Data Processing Addendum.
Last updated: October 15, 2026
Infrastructure sub-processors
| Sub-processor | Purpose | Data processed | Region |
|---|---|---|---|
| Anthropic (Claude) | AI generation — briefs, coaching, artifacts | Prompts derived from your data; retained by Anthropic for up to 30 days for safety and abuse-monitoring per Anthropic's published policy, then auto-deleted (narrow carve-outs apply for legal process and Usage Policy enforcement); no training on Customer Data | United States |
| OpenAI | Text embeddings for retrieval (embeddings only) | Text converted to vector embeddings; retained by OpenAI for up to 30 days for abuse-monitoring per OpenAI's published policy, then auto-deleted; no training on Customer Data | United States |
| Supabase | Primary database, file storage, hosting | Customer Data at rest (encrypted) | United States |
| Vercel | Application hosting, edge/CDN, web analytics | Request metadata; marketing-site analytics | United States |
| Clerk | Authentication and identity | Account identity — name, email, authentication factors | United States |
| Stripe | Subscription billing and payments | Billing contact; tokenized card details (we never store full card numbers) | United States |
| PostHog | Product analytics | Scrubbed usage events; hashed workspace identifiers; no prompts or Customer content | European Union (EU data residency) |
| Sentry | Application error monitoring | Stack traces and error metadata; request bodies, cookies, and PII scrubbed before transmission | United States |
| Resend | Transactional and brief-delivery email | Recipient email address and message content (your briefs) | United States |
| Inngest | Background job orchestration | Job payloads, which may reference Customer Data | United States |
| Tavily | Web search for research features (on request) | Search queries (e.g., company names, URLs) you or the Service initiate | United States |
| Apify | Web-content retrieval for research features (on request) | Public-web fetches driven by your context (jobs, news, reviews) | United States |
| Nimble | Structured web data + prospect enrichment for sensing features | Public-web fetches and company / person lookups initiated by the Service | United States |
| Meta Platforms Ireland Ltd. / Meta Platforms, Inc. (WhatsApp Business Cloud API) | The WhatsApp channel: messages, voice notes and voice calls between a User and Management OS. Meta owns the WhatsApp platform; Twilio (below) is our Tech Provider under Meta's ISV program and operates the WhatsApp Business Account we use. | The User's phone number (E.164); the content of alerts and briefs the User has opted into; messages and voice notes the User sends us; call signaling for voice calls the User places to Management OS; message ids and delivery status. Subject to Meta's WhatsApp Business Terms and Business Messaging Policy | European Union and United States (Meta routing) |
| Deepgram | Speech-to-text for WhatsApp voice notes and the in-app microphone; backup text-to-speech for spoken replies | Audio a User records: WhatsApp voice notes and push-to-talk recordings from the app's microphone, sent to Deepgram Nova-3 for transcription. When ElevenLabs is unavailable, the text of a spoken reply is sent to Deepgram Aura for synthesis. Deepgram is contracted not to train on Customer Data | United States |
| ElevenLabs | Live WhatsApp voice calls with Management OS, and text-to-speech for spoken replies in WhatsApp and the app | Live calls: ElevenLabs hosts the voice agent a User talks to. It receives the call audio in real time, transcribes it, runs the conversation, calls the agent's language model (Anthropic Claude, through ElevenLabs), requests the User's workspace data from Management OS for the duration of the call, speaks the replies, and sends the call transcript to Management OS when the call ends. Spoken replies: the text of a reply, sent for synthesis. ElevenLabs is contracted not to train on Customer Data | United States |
| Unified.to | Integration broker — normalized OAuth connection and data sync for a subset of the CRM, meeting and workspace integrations you choose to connect | OAuth tokens and the records you authorize (contacts, accounts, deals, meetings) in transit and short-term cache; no training on Customer Data | United States |
| Knock2 | Marketing website visitor identification and analytics (mgmt-os.ai marketing pages only; not loaded inside the application) | Website visitor device, IP-derived firmographics and page activity; no Customer Data from the application | United States |
| Google (Analytics / Tag Manager) | Marketing website analytics (mgmt-os.ai marketing pages) | Pseudonymous website usage and device data; no Customer Data from the application | United States |
| Twilio | WhatsApp ISV Tech Provider. Twilio holds the WhatsApp Business Account under Meta's Independent Software Vendor program and operates the WhatsApp number (+1 628 348 6205) on our behalf. Every WhatsApp message between a User and Management OS transits Twilio, and Twilio carries live voice calls from WhatsApp to the ElevenLabs voice agent over SIP. | Recipient phone number (E.164), message content of every inbound and outbound WhatsApp message (text, media, voice notes) exchanged with users who have opted into the WhatsApp channel, Twilio's message SID (used as our stable identifier), delivery status callbacks, and inbound webhook payloads including signature. Voice-note audio files are downloaded from Twilio's media host before being forwarded to Deepgram for transcription. For voice calls, the call audio passes through Twilio in transit to ElevenLabs. Twilio is contracted not to train on Customer Data. | United States |
Customer-directed connections
When you connect a CRM, calendar, meeting tool, file source, data-enrichment provider, personality-intel provider, or other third-party service, that provider is a data source you control — not a sub-processor we impose. You choose what to connect and can disconnect at any time. Each connection, the exact data we read and write, and how to revoke it, is documented in our integration guides.
CRM and pipeline: Salesforce, HubSpot, Pipedrive, Zoho, Attio, Keap, SugarCRM, Reevo, Monaco. Every CRM connection is read-only.
Finance, marketing and intent: QuickBooks (invoices and accounts-receivable aging), Marketo, 6sense, Demandbase.
Knowledge: Guru.
Customer success: Gainsight.
Productivity and workspace: monday.com, Google Workspace, Microsoft 365, Slack, Notion, Box, Dropbox.
Meetings and calling: Gong, Zoom, Fathom, Fireflies, Read AI, Calendly.
Community and design: Common Room (community intelligence), Canva and Figma (design tools connected to the pitch-deck generator), Lightfield (sales-signal enrichment). When connected, MOS reads the specific records you authorize under the OAuth scope you grant — nothing else — and never writes back to these tools without your explicit action.
Data enrichment: Apollo.io. When you connect Apollo, contact identifiers (name, email, LinkedIn URL) are sent to Apollo under your API key to retrieve firmographic and contact-detail enrichment.
Personality intelligence: Crystal Knows, Humantic AI. When you connect either, contact identifiers you elect to enrich (name, email, LinkedIn URL) are sent to that provider under your API key or bearer token to retrieve DISC and, where available, Big Five (OCEAN) personality assessments. You represent that you have a lawful basis for the contacts you enrich, and you are responsible for honoring any opt-out signals the provider surfaces.
Notifications of change
We update this page when a sub-processor is added, removed, or materially changed. Customers under a Data Processing Addendum may subscribe to change notifications — email privacy@mgmt-os.ai to be added to the list.
Questions
Privacy & data: privacy@mgmt-os.ai
Security: security@mgmt-os.ai