Legal
Subprocessors
Last updated: October 2, 2026
A subprocessor is a company we use to run Mandala Computer that may handle your data along the way. This page lists every one of them. The privacy policy refers to it, and we update it when the list changes.
Current subprocessors
| Company | What we use it for | What it handles |
|---|---|---|
| Cloudflare | DNS, TLS and network protection in front of this site and the app, and this site's cookieless page counts | Traffic to the dashboard and API on its way to us, including the live screen, terminal and event streams |
| Stripe | Payments, subscriptions and invoices | Your billing details; your card number goes to Stripe, never to us |
| Brevo | Sending account email: verification, password resets, invitations and notices | Your email address and the messages we send you |
| Zoho | Our mailboxes, such as hello@, security@ and abuse@ | Email you send us, and messages from the dashboard's support form |
Where your data lives
We run Mandala Computer on servers we own and operate ourselves, in the United States. Your computers, their disks and snapshots, and our databases are kept there. We don't use a hyperscale cloud such as AWS, Google Cloud or Azure. The companies above may process what they handle in other regions, under their own terms.
Model providers
The built-in agent loop and the OpenAI-shaped endpoint call Anthropic with your own API
key, which you send as X-Model-Key. That traffic is under your own agreement
with Anthropic, so Anthropic is not our subprocessor for it. The same goes for an agent you
run on a computer, such as Claude Code, Hermes or OpenClaw, signed in to your own model
provider.
Changes
When we add or remove a subprocessor, we update this page and its date.
Contact
Questions about this list: [email protected].