Last updated: November 10, 2026
OnTask.AI gives Customers reasonable advance notice before adding or replacing a subprocessor and allows objection on reasonable data-protection grounds, as described in the Master Subscription Agreement. To receive notices, e-mail privacy@ontask.ai with "Subprocessor notices" in the subject line.
| Subprocessor | Function | Data involved | Location |
|---|---|---|---|
| Amazon Web Services, Inc. | Hosting, databases, S3 storage, Amazon Bedrock screen-activity AI inference, Amazon SES e-mail | All Customer Data, including screen video and screenshots, webcam recordings and snapshots, face-reference photos, OCR text and AI outputs | United States (us-east-1) |
| Ably Real-time Ltd | Realtime presence and in-app events | User identifiers and presence status | United States / global edge |
| Stripe, Inc. | Payment processing | Billing contact and payment details (card data is entered directly with Stripe) | United States |
| Google LLC (Cloud Vision) | Locating QR codes in screen and webcam images submitted for QR authorization; not used for face verification | The submitted image, which can show the worker, their surroundings or screen content | United States |
| Google LLC (Sign-in, Fonts) | Optional Google sign-in; web fonts | Account e-mail (sign-in); IP address (fonts) | United States |
| Google LLC (reCAPTCHA) | Bot protection on website and portal forms: access requests, account creation and password reset | IP address, browser and device information, and interaction data collected by the reCAPTCHA widget | United States |
| Xirsys, Inc. | Relaying live-view video connections (TURN) when a direct connection is not possible | Encrypted media relay; IP addresses and connection metadata | United States |
| Telnyx LLC | SMS delivery | Recipient phone numbers and message content | United States |
| Calendly LLC | Demo booking, only when a visitor chooses to use it | Name, e-mail and scheduling details entered by the visitor | United States |
Face verification runs on OnTask.AI's own AWS workers using InsightFace; no third-party face-recognition API receives face data.