Who runs the hosted service
These are the providers Takibi uses to run the product. Polar is merchant of record for paid plans; it is listed because checkout and subscriptions go through it, not because it stores your knowledge base. Some providers use their own sub-processors, including AI providers, under their own terms; this list covers the providers Takibi itself uses.
Sevalla / Kinsta
- Purpose
- Application hosting, managed Postgres and object storage
- Data involved
- Account records, workspace documents and converted text, tasks, usage and operational records. A separate webhook forwarder (hooks.takibibase.com) passes signed task webhooks to the companion service without storing them.
- Location and arrangement
- One production application replica and managed Postgres on Sevalla (Kinsta), in the region configured for the deployment. Sevalla’s object storage and HTTP ingress run on Cloudflare infrastructure (Cloudflare R2), under Sevalla/Kinsta’s terms; the backup bucket is configured in Western Europe. Application origin: app.takibibase.com.
TypeSafe / Jev
- Purpose
- AI judgments for retrieval, imports and content checks
- Data involved
- Questions, document excerpts or text, filenames and context for those features. List, get and ordinary search do not call Jev.
- Location and arrangement
- Processed via TypeSafe’s API under its customer agreement. TypeSafe publishes a DPA. Not described as EU-only.
Prized
- Purpose
- Hosting for the companion service (Chat and companions) and its database
- Data involved
- Chat conversations, companion settings and instructions, run records and costs, working files of companion runs, connected-app records, and model keys you add (stored encrypted). Outbound requests to model, search and app providers pass through Prized’s secrets broker, which adds Takibi’s API keys to them.
- Location and arrangement
- A Prized server. Prized lists Amazon Web Services among its providers, and states that a server’s disk stays in the region chosen for it, and that session traffic and command history are stored or relayed in the US.
OpenRouter
- Purpose
- Routing AI model requests for Chat and companions
- Data involved
- Chat messages and conversation context, the cards and document excerpts read for an answer, companion task context, instructions and working text, tool results, and companion, run and task identifiers. For companion runs, Takibi asks OpenRouter to use only providers that do not train on or publish prompts. On Takibi’s included AI usage, requests go only to providers that do not train on or publish your data; providers may keep requests for a short time under their own terms, for example to detect abuse. With your own key, your OpenRouter account settings apply instead.
- Location and arrangement
- OpenRouter, Inc. is a US company. Requests on your own OpenRouter key run under your account and its provider and region settings, not Takibi’s.
AI model providers through OpenRouter
- Purpose
- Running the included models: Xiaomi MiMo (the default, and Chat) and Anthropic Claude Haiku (the EU option for companions)
- Data involved
- The request content OpenRouter forwards for each model call.
- Location and arrangement
- MiMo: served by a provider OpenRouter chooses, which can be outside the EEA. Claude Haiku: restricted to Google Vertex (Europe) and Amazon Bedrock (eu-west-1, Ireland), with no fallback.
Exa
- Purpose
- Web search and web page reading for companions
- Data involved
- Search queries and web page addresses a companion requests, and the results and page text returned. Queries are written by the companion and can reflect the task it is working on. Chat does not use web search.
- Location and arrangement
- Exa is based in the United States.
Composio
- Purpose
- Connected apps for companions, for example Google Docs, Sheets and Drive
- Data involved
- Connection records and access tokens for the app accounts you connect, and each tool call’s inputs and the app’s answer, such as document or spreadsheet content. App logos in the app load from Composio, which sees your IP address and browser details.
- Location and arrangement
- Composio’s privacy policy is issued by Sampark Inc.; region not specified here. The connected app itself processes data under your own account and agreement with it.
boat
- Purpose
- Temporary virtual machines for companion runs
- Data involved
- The task prompt, the run’s working files and session, and what the companion reads or writes while it runs. Each machine is created for one run attempt, is set up by default to reach only Takibi’s companion service, and is deleted at the end. Disk snapshots are off.
- Location and arrangement
- boat is operated by Dedale, a Delaware company, which states that sandboxes run in the EU (currently Germany, Finland and France).
Tailscale
- Purpose
- Secure network access to the companion service
- Data involved
- Encrypted connections from the webhook forwarder, run machines and the Takibi API to the companion service, with connection metadata such as IP addresses. Tailscale states that its Funnel relay servers do not decrypt this traffic.
- Location and arrangement
- Region not specified here; see Tailscale’s privacy policy.
GitHub (Actions)
- Purpose
- Nightly backup mirror of object storage
- Data involved
- Original uploaded files and avatars, copied from the live storage bucket to the separate backup bucket by a scheduled job using bucket credentials.
- Location and arrangement
- GitHub-hosted runners. Region not specified here; see GitHub’s privacy statement.
Resend
- Purpose
- Account, support and production security-alert email delivery
- Data involved
- Recipient email addresses; verification, password-reset and sign-in verification messages, including action links or codes; support correspondence and contact details; and redacted production error alerts containing error categories, route templates and timestamps. Security-alert emails exclude raw errors, credentials and workspace document content.
- Location and arrangement
- Transactional mail from send.takibibase.com. The sending region configured for that domain is Ireland (eu-west-1).
Rybbit
- Purpose
- Web analytics for the marketing site and optional app analytics
- Data involved
- Page and device signals, selected product events and redacted server error reports (error category and route template). Event properties may include counts and operational identifiers. Rybbit states that it uses no cookies and that IP addresses are used only to derive country and region and are never stored. The sample workspaces do not load this integration.
- Location and arrangement
- Region not specified here; see Rybbit’s terms. App events are only sent when the app is built with a Rybbit site ID.
Polar
- Purpose
- Checkout, subscriptions and customer billing portal
- Data involved
- Customer and billing details, subscription state and payment information. Takibi stores subscription identifiers and status; card entry happens on Polar. Polar is merchant of record and handles buyer and payment data as its own controller, under its own terms — that is not the same as hosting workspace documents.
- Location and arrangement
- International billing. See Polar’s legal documents for entities and payment providers.
Oh Dear
- Purpose
- Uptime monitoring, application health checks and the public status page
- Data involved
- Monitoring results: reachability of public URLs and the application health summary (database, schema, storage, mail, billing and AI-ranking check states, plus failure notices). No workspace documents, keys or account records. Status-page subscribers give Oh Dear their email directly.
- Location and arrangement
- Oh Dear states that its primary data is stored in Belgium (EU). Status page at status.takibibase.com; health results are secret-gated and never public.
Tools you choose
An agent you connect to Takibi receives the passages and task information its Profile may access. If you paste a consolidation prompt into another tool, you choose to send that content to it. Those tools and artifact destinations are services you select, rather than providers appointed by Takibi. The same applies to your own OpenRouter key and to the app accounts you connect for companions: with your own key, OpenRouter handles routing and you’re responsible for where your data goes. You can restrict providers and regions in your OpenRouter settings. Composio, which relays connected-app calls, is listed above.
Changes and questions
We will update this list when providers or regions change.
For questions about these providers, contact support@takibibase.com. See also Privacy and Terms of service.