Service providers & processing register
Notice version: 2026-09-19. Operator review pending.
Draft — operator review required. The operator’s public business address, retention schedule, international-transfer arrangements and final legal review are still pending. These pages describe the implementation and proposed terms; they are not a completed compliance assessment or an effective new contract.
Scope of this register
This is a technical inventory derived from the repository, not an approved contractual subprocessor list. Enabled providers vary by deployment and selected feature. Legal entities, processing locations, contracts, transfer mechanisms and change-notification commitments need operator confirmation.
Cloudflare
The hosted implementation uses Cloudflare for delivery, Workers, application storage and sandboxed execution; configured services include D1, R2, Durable Objects and optional AI infrastructure. Relevant information can include request metadata, workspace content, files, execution state and logs. Exact regions and retention depend on service configuration.
Authentication
Hosted sign-in is configured through Supabase Auth. Account/profile information and session credentials support authentication. The operator must verify the configured project, region and authentication providers; self-hosted deployments may differ.
Dodo Payments
Dodo Payments is the merchant of record for hosted purchases. Billing contact information, customer identifiers, subscription and usage information are exchanged for checkout, invoices, tax handling, renewals, refunds and disputes. The checkout request also includes the accepted Octonode policy version, acknowledgement time and account identifier. Dodo’s own buyer terms and privacy notice apply to its processing; its payment role is not described as merely a software subprocessor.
GitHub and integrations
When authorized, repository integrations exchange selected source, repository metadata, commits and account/installation information with GitHub. Visual-review approval can write a baseline commit. Other customer-configured workflow integrations receive data according to their node configuration and permissions.
AI services
Optional assistant and workflow features may send prompts, selected project context and tool outputs to the configured AI provider. The repository includes OpenAI, Anthropic/Claude and Cloudflare AI paths. Availability, provider retention and training settings must be verified per deployment; this notice makes no blanket no-training promise. Avoid secrets or personal data unless authorized and covered by the relevant agreement.
Customer processing agreements
Business customers needing a data-processing agreement should request one before uploading regulated personal data. A complete agreement must address roles and instructions, confidentiality, security, subprocessors, rights assistance, incidents, deletion/return, audit rights and international transfers. This inventory is not a signed DPA.
Purchases through Dodo Payments are also governed by the Dodo buyer terms. See Dodo’s privacy policy for its data practices.