Capable — Sub-processors
Last updated: 2026-10-19
This page lists the third-party sub-processors that Capable Agents AB (organisationsnummer 559504-0444, VAT SE559504044401) ("Capable") engages to process Customer Data in providing the Services. It supplements our Data Processing Agreement (Annex III) and Privacy Policy.
Change notification
We may add or replace a sub-processor as the Services evolve. When we do, we update this page and actively notify the customer's designated contact or an authorised administrator by email or in-product notice. No separate notification subscription is required. Customers then have a reasonable period — at least thirty (30) days unless a shorter period is required for security or legal reasons — to object on reasonable data-protection grounds, as described in Section 6.3 of the DPA. To update a notification contact or raise an objection, email hello@capable.run.
Clarification on 2026-10-19. Unipile’s entry specifies all synchronized V1 messages, chats, attendees and attachments held beyond Capable’s local import selections, links the revised vendor DPA, and distinguishes vendor-stated locations from verified account routing. This describes the existing integration; no sub-processor is added or replaced and no data flow changes through this update.
Clarification on 2026-10-17. The Upstash entry no longer describes the service as a "graceful no-op when unconfigured": in production the shared backend is required, and if it is unavailable Capable refuses write and resource-intensive assistant actions rather than running without limits. No provider or data flow changed.
Clarification on 2026-10-12. Unipile's entry now distinguishes account-level provider synchronization from selected local imports and describes possible onward processing outside the EU. This updates the description of the existing integration; it does not add a new provider or enable new features.
Changes on 2026-10-01. The notification wording now expressly provides active customer notice without requiring a separate subscription. The sub-processor list and data flows are unchanged by this clarification.
Also on 2026-10-01. PostHog now also sends onboarding emails (starting with a welcome email after sign-up) to Authorized Users on Capable's behalf. For that it holds the Authorized User's email address and first name. This concerns Capable's own relationship with its users, not Customer Data, and no Customer Data flow to PostHog changed.
Changes on 2026-09-30. Stripe is now live (it was previously marked planned). WorkOS (enterprise single sign-on and directory sync) and Unipile (LinkedIn conversation sync, beta) are added. The purposes of Supabase, Google, Microsoft, Recall.ai, Inngest and Resend are described more completely; no data flow to those vendors changed on this date.
Current sub-processors
| Sub-processor | Purpose | Data processed | Location / region |
|---|---|---|---|
| Supabase | Primary data store, authentication, file storage (uploaded record attachments), backups (PITR) | All Customer Data; Authorized User identity; uploaded files | European Union (eu-west-3, Paris) |
| Vercel | Application + MCP server hosting, edge, deployment, logs | Customer Data in transit; request/operational logs | EU (Paris / cdg1) / global edge |
| Identity provider (Google Sign-In) and, on the customer's authorisation, the source of Gmail data and Calendar data, and the calendar on which meeting holds and invitations scheduled through Capable are created | Authorized User identity; email header metadata (stored); email message content (stored encrypted at rest, access-controlled, returned to connected AI assistants only on authorized requests, purged on deletion); calendar event metadata + the event description (meeting agenda) stored on the activity (scrubbed of obvious join credentials, encrypted at rest, returned to connected AI assistants only on authorized requests, purged on deletion; never calendar locations/attachments); calendar events Capable creates on the user's instruction | United States / global | |
| Microsoft | Identity provider (Sign in with Microsoft / Microsoft Entra ID) and, on the customer's authorisation, the source of Outlook (Microsoft 365) mail data and Calendar data via Microsoft Graph, and the calendar on which meeting holds and invitations scheduled through Capable are created | Authorized User identity; email header metadata (stored); email message content (stored encrypted at rest, access-controlled, returned to connected AI assistants only on authorized requests, purged on deletion); calendar event metadata + the event description (meeting agenda) stored on the activity (scrubbed of obvious join credentials, encrypted at rest, returned to connected AI assistants only on authorized requests, purged on deletion; never calendar locations/attachments); calendar events Capable creates on the user's instruction | Global (US / EU; Microsoft 365 data residency is tenant-dependent) |
| WorkOS, Inc. | Enterprise single sign-on (SAML / OIDC) and directory sync (SCIM), for workspaces whose organisation enables them | Authorized User identity (email, name); organisation/workspace name and domain; organisation, user, directory and group identifiers; group membership and active/inactive state; SSO connection and authentication metadata | United States (primary and backup hosting) |
| Recall.ai | Meeting-recorder bots that join and record video calls (on by default for new workspaces, for meetings with at least one external attendee; the workspace admin can switch it off, and attendees can opt out of a recording) | Meeting audio/video, transcripts, recording links, participant metadata | European Union (eu-central-1, Frankfurt) — configured via RECALL_REGION=eu-central-1 |
| Deepgram | Speech-to-text transcription of recordings, routed through Recall.ai (BYO provider) | Meeting audio for transcription | European Union (routed through Recall.ai's EU deployment) |
| Unipile SAS (beta) | Connected LinkedIn account synchronization where enabled: provider-side full history synchronization and conversation discovery; Capable imports message bodies only for selected conversations linked to a live CRM contact | Connected-account and session identifiers; all synchronized V1 messages, chats, attendees and attachments, including provider-held history beyond locally selected conversations; delivery metadata | Vendor-stated France hosting; optional onward proxy/support processing may include Israel, the United States and Singapore depending on service/configuration; actual account routing remains under review; see the vendor DPA below |
| Inngest | Background-job orchestration (inbox import and continuous mail/calendar sync, product-event capture, outreach-sequence reminders, scheduled report digests, recorder routing and pre-meeting recording notices, billing reconciliation) | Customer Data referenced by background jobs (event metadata, identifiers) | US / global |
| Resend | Transactional email delivery (sign-in codes, workspace invites, scheduled report digests, trial and billing notices, transcript-ready notices, and pre-meeting recording notices sent on the meeting host's behalf) | Recipient email address and the content of those emails. Recipients include people who are not Capable users: invitees, and external meeting attendees who receive a recording notice | US / global |
| Sentry | Application error and performance monitoring | Error/diagnostic metadata (configured not to send personal data by default) | US / global |
| PostHog | Product analytics (cookieless, metadata-minimized); onboarding emails to Authorized Users (for example the welcome email after sign-up) | Metadata-minimized usage signals (tool/kind/latency/error class); Authorized User identifier; Authorized User email address and first name, and the content of those onboarding emails | European Union (EU-hosted) |
| Upstash | Rate limiting and caching (Redis) | Short-lived cache keys (e.g. workspace settings, domain facts); rate-limit counters | US / global |
| Brandfetch | Company-level (domain) firmographic facts | Company domain and public company facts (not individual personal data) | US / global |
| Logo.dev | Company logos by domain | Company domain (not individual personal data) | US / global |
| Stripe | Payments, invoicing, tax calculation, customer billing portal | Billing contact, billing address, VAT / tax IDs, invoices and payment status (card data is entered on Stripe's pages and handled by Stripe, not stored by Capable) | US / global |
Unipile's revised DPA, Annex 1 lists its hosting, optional proxy and support providers and their stated transfer safeguards. The inventory describes available services; it does not mean every listed provider processes every connected account. Unipile confirms that all synchronized V1 messages, chats, attendees and attachments are stored until connected-account deletion, independent of Capable's local import selections. Account-specific routing, residual retention and backup-restoration evidence remain under review.
Connected IMAP mailboxes add no sub-processor. Where a customer connects a mailbox over IMAP (as an alternative to Google or Microsoft — e.g. Fastmail, iCloud, Yahoo, or a company mail server), Capable connects directly to the customer's own mail provider. That mail provider is the customer's chosen mail host, not a sub-processor of Capable, so it is not listed above. The mail we read is then processed by the same sub-processors that run the rest of the Services (Supabase for storage, Inngest for background jobs, Vercel for hosting). The mailbox credential is stored encrypted at rest under a dedicated key (see the Privacy Policy §4.1b and §10).
The customer's own systems are not sub-processors. Where a customer's own product sends sign-up and usage events to Capable through the inbound capture API (see the Privacy Policy §4.8), the customer's system is the source of that data, not a processor engaged by Capable. The events are then processed by the same sub-processors that run the rest of the Services.
User-connected AI assistants
Capable does not operate a server-side large language model or make server-side model inference requests on your behalf. Authorized Users can connect supported AI assistants through MCP (Model Context Protocol), including Anthropic's Claude and OpenAI's ChatGPT and Codex, using their own provider accounts. On an authorized request, Capable returns the requested, permitted Customer Data to the connected assistant and can perform permitted CRM actions. Data returned through MCP is disclosed to and processed by the connected assistant provider under the agreement, account type, and settings applicable to the Authorized User or their organisation. Users and workspace administrators control these connections and can revoke access.
The list above covers providers Capable engages to operate its Services. The assistant connections described here use the Customer's or Authorized User's own provider accounts; the applicable provider relationship depends on those agreements. This architecture is described consistently in the Terms of Service (Sections 6–7), Privacy Policy (Section 4.4), and DPA (Section 12).
Questions: hello@capable.run