CognoCogno Subprocessor List
Version: v1.0 Effective Date: August 25, 2026 Last Revised: August 25, 2026
This page is the Subprocessor list referenced in Section 10 of the Cogno Terms of Service and Sections 10 and 11 of the Cogno Privacy Policy.
A Subprocessor is a third party engaged by Genaxis, Inc. ("Company") to process Customer Data on the Company's behalf in the course of providing Cogno (the "Service"). The Company remains responsible to Customers for the acts and omissions of its Subprocessors.
Every Subprocessor below is bound by a written agreement imposing confidentiality and data protection obligations no less stringent than the Terms and the Privacy Policy, including standard contractual clauses or an equivalent transfer mechanism where personal information leaves Japan.
1. Infrastructure and Hosting
| Provider | Service Provided | Data Handled | Processing Location |
|---|---|---|---|
| Google LLC (Google Cloud) | Application runtime, primary database, object storage, secret management, container registry | All Customer Data: tasks, comments, documents, uploaded files, meeting recordings, account information, application logs | asia-northeast1 (Tokyo, Japan) |
| Vercel, Inc. | Hosting and CDN for the marketing site (cogno.studio) and the web application (app.cogno.studio) | Access logs, request metadata, IP addresses, cookie identifiers | Server-side rendering in the United States (iad1, Washington, D.C.); static delivery from edge locations worldwide, including Tokyo |
| Supabase Pte. Ltd. | Authentication (sign-in, session issuance, JWT) and the managed database backing the Company's self-hosted integration gateway | Email addresses, user identifiers, authentication tokens, integration OAuth credentials | ap-northeast-1 (Tokyo, Japan) |
The Company's collaborative editing server (Hocuspocus) and integration gateway (Nango) run as self-hosted images on Google Cloud Run in Tokyo. They are the Company's own infrastructure, not third-party services, and no Customer Data is transmitted to their upstream vendors.
2. AI Processing
| Provider | Service Provided | Data Handled | Processing Location |
|---|---|---|---|
| Amazon Web Services, Inc. (Amazon Bedrock) | Large language model inference (Anthropic Claude Sonnet 4.5) | Content submitted as prompts: task descriptions and comments, documents, meeting transcripts, and repository context supplied by the Customer | ap-northeast-1 (Tokyo), using the Japan cross-Region inference profile jp.anthropic.claude-sonnet-4-5 |
Data residency. The Service calls Claude exclusively through the Japan cross-Region inference profile. Requests are processed entirely within Japanese AWS Regions (Tokyo and Osaka) and routed over the AWS internal network without traversing the public internet.
Model provider access. Because inference runs inside Amazon Bedrock, prompt content is not disclosed to the model provider (Anthropic, PBC) and is not used to train any model, in accordance with the Amazon Bedrock service terms.
Sole inference path. All large language model inference in staging and production runs through Amazon Bedrock. The Google Generative AI SDK present in the codebase serves a fallback that activates only in local development environments where Bedrock is unconfigured, and is not invoked in production.
3. Meeting Recording (Cogno Notetaker)
| Provider | Service Provided | Data Handled | Processing Location |
|---|---|---|---|
| Hyperdoc Inc. (d/b/a Recall.ai) | Meeting bot that joins calls, captures audio and video, and produces transcripts; calendar sync that schedules bots for upcoming meetings | Meeting audio and video, transcript text, participant display names, meeting metadata; for Customers who connect a calendar, event titles, times, and meeting URLs | ap-northeast-1 (Recall.ai Asia region, Tokyo) |
Retention. Video recording is enabled on the Service, so recordings are deleted from Recall.ai after 7 days. Recordings the Customer retains are transferred to the Company's Google Cloud Storage bucket in Tokyo and deleted after 90 days, with a bucket-level lifecycle rule deleting any remaining object at 120 days.
Notice to participants. The bot joins under a visible display name and, by default, posts a notice in the meeting chat stating that the meeting is being recorded.
Recall.ai's own subprocessors. Recall.ai engages its own subprocessors, including for transcription. Its current list is published at security.recall.ai/subprocessors.
4. Integration Infrastructure
| Provider | Service Provided | Data Handled | Processing Location |
|---|---|---|---|
| Sampark Inc. (d/b/a Composio) | OAuth brokering and tool catalog for the Customer's own Sentry connection, the only integration routed through Composio today | OAuth credentials for that connection and the issue data retrieved through it | United States |
5. Payments
| Provider | Service Provided | Data Handled | Processing Location |
|---|---|---|---|
| Stripe, Inc. | Subscription billing, checkout, and the customer billing portal | Billing contact details, email address, subscription and invoice records, payment method identifiers | United States |
Card numbers and other payment credentials are collected by Stripe directly and never pass through or are stored on the Company's systems.
6. Monitoring and Analytics
| Provider | Service Provided | Data Handled | Processing Location |
|---|---|---|---|
| Functional Software, Inc. (d/b/a Sentry) | Error tracking and performance monitoring | Stack traces, error messages, request metadata, user and workspace identifiers | European Union (Sentry EU data region, Germany) |
| PostHog, Inc. | Product usage analytics | Product events, user and workspace identifiers, device and browser information, IP addresses | United States (PostHog US Cloud) |
7. Email
| Provider | Service Provided | Data Handled | Processing Location |
|---|---|---|---|
| Plus Five Five, Inc. (d/b/a Resend) | Transactional email delivery — workspace invitations, notifications, and contact form messages | Recipient email address, display name, message content | United States |
8. Documentation Site
| Provider | Service Provided | Data Handled | Processing Location |
|---|---|---|---|
| Mintlify, Inc. | Hosting for the developer documentation served at cogno.studio/docs | Documentation page requests and their metadata | United States |
The documentation site contains no Customer Data.
9. Not Subprocessors
The following receive data but are not Subprocessors of the Company, because the Customer directs the transfer and holds its own relationship with the provider.
Customer-connected services. Slack, Discord, Microsoft Teams, GitHub, Google Workspace (Calendar and Gmail), and Chatwork. The Customer authorizes each connection and controls its scope; the Company transmits data to these services only as instructed through the Service. Each provider's own terms and privacy policy govern the data once it arrives.
Customer-supplied coding agent credentials. Where a Customer supplies its own Anthropic API key, Claude Code subscription token, or OpenAI API key, the resulting coding agent runs on the Customer's own host under the Customer's own agreement with that provider. The Company does not hold a processing relationship with Anthropic, PBC or OpenAI for this traffic.
10. Changes to This List
10.1 The Company will update this page before, or as soon as reasonably practicable after, engaging a new Subprocessor.
10.2 Material additions will be announced on the Company's website and, for Customers on a written agreement, by email to the registered administrative contact.
10.3 A Customer with a reasonable data protection objection to a new Subprocessor may raise it in writing to privacy@cogno.studio within thirty (30) days of notice. The Company will work in good faith to offer a commercially reasonable alternative; if none is available, the Customer may terminate the affected Service in accordance with the Terms.
11. Requests and Contact
For a copy of this list as of a particular date, a data processing agreement, or a security questionnaire, contact:
Genaxis, Inc. Delaware, United States of America Japan contact office: MIEUX Shibuya Building 8F, 5-3 Maruyamacho, Shibuya-ku, Tokyo 150-0044, Japan Contact: privacy@cogno.studio