Subprocessor List
Cracked Robot, Inc. · Last updated October 2, 2026
The subprocessors
Cracked Robot delivers its services with a platform of its own: the tooling it uses to produce deliverables for its customers. The providers below process customer data for Cracked Robot in the course of that work.
| Subprocessor | Legal entity | Location | Function | Data processed | Retention | Provider terms |
|---|---|---|---|---|---|---|
| Anthropic | Anthropic, PBC | USA | LLM inference for the AI agents | Prompt inputs and outputs, containing only the personal information needed for the task | The provider's standard API retention; not used for training | Anthropic's terms |
| OpenAI | OpenAI, L.L.C. | USA | LLM inference and embeddings | Prompt inputs and outputs, containing only the personal information needed for the task | The provider's standard API retention; not used for training | OpenAI's terms |
| Railway | Railway Corp. | USA | Cloud hosting of the application, database and storage | All customer data processed by the platform, encrypted at rest and in transit | The engagement term plus the deletion period in the customer agreement | Railway's terms |
| Fly.io | Fly.io, Inc. | USA | The machines that run the platform's autonomous sessions: one machine per run | The project's code checkout and the work in progress of the run | The length of the run; the machine is destroyed when the run ends | Fly.io's terms |
| OpenRouter | OpenRouter, Inc. | USA | Routing of requests to AI models, for the platform's chat and autonomous sessions | Prompt inputs and outputs, passed on to the provider of the model chosen | The provider's standard API retention | OpenRouter's terms |
| Google LLC | USA | Sign-in with Google, delivery of our email, and visit counts on the public pages of openweave.dev | Name and email address from the Google account; the emails we send; visits to the public pages | The provider's standard retention | Google's terms |
Last updated: October 2, 2026
Providers a customer supplies
In addition to the subprocessors above, the platform can use providers that a customer itself supplies: for example the customer's own account with a model provider, a code host or a cloud provider. Such a provider is used at the customer's direction, under the customer's own agreement with that provider, and as agreed between the customer and Cracked Robot. It is not listed here.
The same holds for a service a customer connects to a project, such as a code repository: we read and write there at the customer's direction, and it is the customer's provider, under its agreement with it.
AI model providers
Anthropic and OpenAI are used directly. A request that goes through OpenRouter is passed on to the provider of the model that was chosen for it; which provider receives it depends on that choice, and every model is named with its provider where it is chosen.
Subprocessors engaged for one customer's engagement only are disclosed to that customer under its agreement.
Notice of changes
Customers under a Data Processing Addendum may object to changes in accordance with that Addendum. Notice of changes is given by posting here, and we inform the customers we work with directly.
Questions about this list: hello@cracked.bot.