Who handles your data,and where.
Everything in CORA stays in the EU. These are the companies that process workspace content or account data for CORA, what each one does, and where.
Sub-processors
8 sub-processors, all in the EU. EU Strict uses the same list.
| Company | What it does | Where |
|---|---|---|
| SupabaseDatabase, file storage, sign-in and backups | Database, file storage, sign-in and backups | EUFrankfurt, Germany |
| VercelHosting the web app; cookieless page-view counts | Hosting the web app; cookieless page-view counts | EUFrankfurt, Germany |
| Fly.ioBackground work: indexing, agent runs, page fetching | Background work: indexing, agent runs, page fetching | EUFrankfurt, Germany |
| Microsoft AzureAI models (OpenAI's GPT models, CORA's default), search embeddings, text recognition in PDFs, image generation, speech-to-text, and sealed, network-free Python runs on Project files | AI models (OpenAI's GPT models, CORA's default), search embeddings, text recognition in PDFs, image generation, speech-to-text, and sealed, network-free Python runs on Project files | EUSweden Central; language models in the EU Data Zone |
| Amazon Web ServicesAI models (Anthropic's Claude) on Amazon Bedrock: when a workspace chooses Claude, and as a backup when another AI cloud is busy or down | AI models (Anthropic's Claude) on Amazon Bedrock: when a workspace chooses Claude, and as a backup when another AI cloud is busy or downAdded 31 October 2026. Not used before 1 December 2026 | EUEU regions: Frankfurt, Stockholm, Ireland, Paris, Milan, Spain |
| Google CloudAI models (Anthropic's Claude, Google's Gemini, and OpenAI's GPT models once Google runs them in the EU): when a workspace chooses them, and as a backup when another AI cloud is busy or down | AI models (Anthropic's Claude, Google's Gemini, and OpenAI's GPT models once Google runs them in the EU): when a workspace chooses them, and as a backup when another AI cloud is busy or downAdded 31 October 2026. Not used before 1 December 2026 | EUEU regions (EU member states only) |
| LinkupPublic web search, and reading a public web page or PDF that Firecrawl and CORA's own reader cannot read; receives only the search query or the page address | Public web search, and reading a public web page or PDF that Firecrawl and CORA's own reader cannot read; receives only the search query or the page addressZero retention, EU processing by agreement | EUFrance |
| MailgunSign-in, notification email, managed mailboxes and Agent email | Sign-in, notification email, managed mailboxes and Agent email | EUGermany and Belgium, EU region |
Card payments go through Stripe, in Ireland and the United States. Stripe handles CORA’s own billing records, never workspace content, so it is not a sub-processor. Any workspace may pay by card, EU Strict included. Workspaces billed by invoice do not use Stripe.
To read a public web page for an agent, a chat or a website import, CORA may send the page’s address to Firecrawl in the United States, which fetches the page and returns its text. Firecrawl receives the address only: never workspace content, who asked, a share link or a signed address. It reads the public web, not your data, so it is not a sub-processor.
Updated 31 October 2026. Questions, or a copy of a sub-processor’s data processing agreement: cora@hellocora.co.