Kepaio Subprocessors
Last updated 12 November 2026
Kepaio is operated by HBS MANAGEMENT SARL AU. This page lists the providers that support Kepaio and explains their roles. Under our Data Processing Agreement, a subprocessor is a provider Kepaio engages to process Customer Personal Data on its behalf.
Subprocessors
| Provider | Service | Data involved |
|---|---|---|
| WorkOS | Authentication and account access | Account identifiers, email addresses, and information needed to authenticate users and manage sign-in. |
| Cloudflare | Application infrastructure and database | Workspace and app configurations, structured records, and request information needed to operate the service. |
| OpenAI | Content moderation, under Kepaio's own API account | To check content against the Acceptable Use Policy, the text of app configurations and store submissions, app logos, and example records submitted to the store. This is separate from the ChatGPT integration below. |
Other service providers
| Provider | Role | Data involved |
|---|---|---|
| OpenAI / ChatGPT | Customer-enabled integration that provides AI capabilities. Kepaio supplies the app structure and database. | When a connected user invokes a Kepaio action, ChatGPT may send tool inputs to Kepaio and receive authorized app configurations, records, or action results. OpenAI handles that information under the terms applicable to the user's ChatGPT account. |
| Armitage Labs OÜ (Creem) | Merchant of record for purchases made through Creem. | Creem handles checkout and payment information, receipts, applicable transaction taxes, and refunds. Kepaio receives subscription status and transaction information needed to manage paid access and support. |
Processing locations and transfers
Processing locations depend on the service and its configuration. Customers can contact us for the locations and applicable transfer safeguards relevant to their use of Kepaio. The agreed Annex C of the DPA records the processing and remote access locations and the applicable transfer mechanism.
Changes to subprocessors
For customers covered by the DPA, Kepaio provides written notice at least 30 days before a new or replacement subprocessor begins processing Customer Personal Data. Customers may object during that period on reasonable data protection grounds, as described in the DPA.
For questions about this list or to submit an objection, email contact@kepaio.com.