Sub-processors
Last updated: October 24, 2026
MontourLink uses the service providers below to process client data.
MontourLink updates this list before adding a new provider.
Questions: info@montourlink.com
The date added on every row is October 24, 2026, the date this list started.
Each cited fact is limited to that provider's public terms.
| Provider | Purpose | Data it touches | Processing location | Trains on client data? | How long the provider keeps data | Date added |
|---|---|---|---|---|---|---|
| Google Workspace (opens in a new tab) | Drive file storage and email. | Client files in Drive, and email. | Per Google's terms. On an in-scope edition, a customer may select a data region (the United States or Europe, except Europe only for AppSheet). If one is selected, Google stores covered data at rest, and where the edition covers it processes that data in use, only in that region. Data the data region policy does not cover may be stored or processed wherever Google or its subprocessors maintain facilities. source: Google Workspace service terms, data regions (opens in a new tab) source: Google Workspace data regions help (opens in a new tab) | Per Google's terms. Google will not use customer data to train or fine-tune its generative artificial intelligence models that support the Google Workspace generative AI services without prior permission or instruction. source: Google Workspace service terms, training restriction (opens in a new tab) | Per Google's data processing addendum. After customer data is deleted so it cannot be recovered, Google deletes it within a maximum of 180 days, unless European Law requires storage, where European Data Protection Law applies, or applicable law requires storage, where any other Applicable Privacy Law applies. After the contract ends, remaining customer data is deleted within a maximum of 180 days after a recovery period of up to 30 days, unless European Law requires storage, where European Data Protection Law applies, or applicable law requires storage, where any other Applicable Privacy Law applies. source: Google Cloud Data Processing Addendum, section 6 (opens in a new tab) | October 24, 2026 |
| Grok Bot (Cursor) (opens in a new tab) | AI agent workspace that operates on client files. | Client files. | Per Cursor's security page. Cursor does not use or maintain any infrastructure in China. That page does not name a processing country. source: Cursor security (opens in a new tab) | Privacy Mode is on for this account. Cursor's data-use page says customer data is not used for training, and that model providers do not store or train on it, only when Privacy Mode is on. With Privacy Mode off, Cursor says it may store that data and train its models. source: Cursor data use and privacy (opens in a new tab) | Privacy Mode is on for this account. Per Cursor's data-use page, when Privacy Mode is on, model providers do not store or train on customer data under Cursor's zero data retention agreements. The same page says that if a prompt triggers an abuse detector, that data may be stored for investigation and then deleted under the provider's retention policy, and that models outside those agreements are marked or need an admin to turn them on. Cached file contents are described as temporary and not permanently stored. source: Cursor data use and privacy, retention (opens in a new tab) | October 24, 2026 |
| Brevo (opens in a new tab) | Email sending and marketing contacts (lead forms, newsletter). | Client emails and contact details | Per Brevo's terms. source: Brevo terms, data processing agreement (opens in a new tab) source: Brevo data storage location (opens in a new tab) | AI features not used; Aura AI agents are off. Brevo's built-in fraud and spam checks apply. source: Brevo terms, section 6.7 (opens in a new tab) | Per Brevo's terms. source: Brevo terms, section 7.4 and data processing agreement sections 4.3 and 5.3 (opens in a new tab) | October 24, 2026 |
| TypeSafe AI (jev) (opens in a new tab) | Email sorting AI used for Gmail inbox triage. | Client emails and contact details | United States. TypeSafe's privacy policy says the Services are hosted in the United States. source: TypeSafe privacy policy, international visitors (opens in a new tab) | No, unless the customer gives prior consent. The master customer agreement says TypeSafe will not include customer data in a dataset used to train model weights without prior consent. The privacy policy says TypeSafe will not train or fine-tune models on prompts or other input. TypeSafe's model docs say Jev is not trained on customer requests or responses. source: TypeSafe master customer agreement, section 4.1 (opens in a new tab) source: TypeSafe privacy policy (opens in a new tab) source: TypeSafe model docs, data handling (opens in a new tab) source: TypeSafe help, how submitted data is used or retained (opens in a new tab) | Per TypeSafe's privacy policy, personal data is kept for as long as reasonably necessary to provide the Services, or in support of TypeSafe's business or commercial purposes. The master customer agreement says TypeSafe has no obligation to store customer data, during the term or after it ends, and may delete it at any time. The same agreement says confidential information may remain in TypeSafe's standard backups. source: TypeSafe privacy policy, retention (opens in a new tab) source: TypeSafe master customer agreement, retention (opens in a new tab) | October 24, 2026 |
| Vercel AI Gateway (opens in a new tab) | Routes requests to the jev model for email sorting. | Client emails and contact details | MontourLink's requests to Vercel AI Gateway do not set an inference region, so the documented global default applies. Per Vercel's regional inference docs, a region is chosen per request, that default is global and can differ by request, and a request can be processed in any Vercel region before it is forwarded to the provider. source: Vercel AI Gateway regional inference (opens in a new tab) | No. Every request is sent with Vercel AI Gateway's prompt-training block turned on, so it is only routed to providers that do not train on it. source: Vercel AI Gateway FAQ (opens in a new tab) source: Vercel AI Gateway disallow prompt training (opens in a new tab) | Follows Vercel's standard terms and each routed provider's terms; zero data retention is not enabled. source: Vercel AI Gateway FAQ, logs (opens in a new tab) source: Vercel AI Gateway zero data retention (opens in a new tab) | October 24, 2026 |