Last reviewed 2026-05-20 · DPA available on request.  ·  Email security@slashed.pro to be notified of changes.
// Sub-processor map · verified · plain sight

Four named parties. No hidden data path.

Procurement, legal, and security teams ask one question early: who actually handles our data? Here is the full list — every upstream service in the request path today. Three model-inference providers, plus the VPS host that runs the SLASHED gateway. Nothing aspirational. Nothing illustrative.

— Data flow · one hop, three destinations

Your request, in five boxes.

A single-hop gateway: SDK call → SLASHED edge → provider inference → SLASHED edge → SDK return. No proxy chaining. No vendor side-channel. No customer-prompt write-back to any third-party store.

That's the entire round-trip. The named provider in box 03 is one of three — never an unnamed fourth. The sub-processor list below names which model routes to which.

— The list · four entries · all active

Every party in the request path. Named.

Three model-inference providers handle prompt and completion text. One VPS provider hosts the SLASHED gateway and its first-party metadata store. There are no other third parties in the data path today.

ACTIVE · in the request path today INFRA · hosts SLASHED, not the prompt path
OpenAI, OpenAI OpCo LLC
ACTIVE
Model inference for the GPT-5.x family — GPT-5.5, GPT-5.4, GPT-5.4-mini, GPT-5.3 Codex, GPT-5.2, and Codex Auto-Review.
Incorp.: Delaware, USARole: LLM inferenceData: Prompt + completionSLASHED retention: Zero
Anthropic, PBC
ACTIVE
Model inference for the Claude family — Claude Opus 4.7, Claude Sonnet 4.7, and Claude Haiku 4.5.
Incorp.: Delaware, USARole: LLM inferenceData: Prompt + completionSLASHED retention: Zero
Google LLC (AI Studio / Gemini API)
ACTIVE
Model inference for the Gemini 3.x family — Gemini 3.5 Pro and Gemini 3.5 Flash.
Incorp.: Delaware, USARole: LLM inferenceData: Prompt + completionSLASHED retention: Zero
Peramix Inc
INFRA
VPS hosting for the SLASHED gateway and the first-party PostgreSQL store. Operator of the underlying hypervisor. Customer prompts are never persisted on-disk; metadata stored here is the account, key, and usage ledger.
Incorp.: USARole: VPS hostData: Metadata + transient memoryRetention (prompts): Zero
— First-party · operated by SLASHED, not a sub-processor

The rest of the stack is us.

These components run on the VPS above. They are operated by SLASHED, not by a third party. They are listed for transparency — not because they are sub-processors under GDPR Art. 28.

SLASHED gateway (Envoy + nginx) TLS termination, request routing, key auth. First-party process on the VPS above.
PostgreSQL Account, API-key, and usage metadata only. Co-located on the VPS above. No prompt text.
PowerDNS (authoritative) ns1.slashed.pro / ns2.slashed.pro. Self-hosted on the VPS above. No managed-DNS provider.
Stalwart Mail (loopback) Outbound transactional mail (DPA, security responses). Loopback-only; no third-party mail relay wired today.
— Not in the data path · for the avoidance of doubt

What is not a sub-processor today.

These vendors are common in SaaS sub-processor lists. SLASHED does not use them in the prompt path or for customer-data handling today. If any are added in future, this page is updated 30 days in advance under the commitments below.

No CDN / managed edge No Cloudflare, Fastly, Akamai. Requests hit the SLASHED VPS directly.
No managed DNS No Route53, NS1, DNSimple. DNS is self-hosted PowerDNS.
No payment processor No Stripe, Paddle, Chargebee. Annual / quarterly invoicing today — no card rail.
No transactional-mail vendor No Postmark, Resend, SendGrid, SES. Outbound mail is self-hosted Stalwart.
No product analytics No PostHog, Plausible, Mixpanel, GA. No third-party telemetry from dashboard.
No error / log SaaS No Sentry, Datadog, New Relic, Honeycomb. Logs stay on the VPS above.
— Commitments · what this list cannot grow into

If a name is not on the list, your prompt does not reach it.

A sub-processor list is only useful if it constrains future behaviour. These four commitments are how this page stays honest.

— 01

30-day advance notice

New sub-processors are announced 30 days before activation. The list above is the canonical source — email security@slashed.pro to subscribe.

— 02

No silent additions

This page is the canonical mirror. A new entry is dated on the day it is added; a removed entry stays struck-through until the next quarterly review.

— 03

Self-hosted edition opt-out

Buyers who cannot accept any of the entries above can deploy SLASHED inside their own VPC — provider credentials stay theirs; SLASHED never sees the traffic.

— 04

DPA, countersigned within 48h

Email hi@slashed.pro. The DPA references this page directly and is countersigned by a founder, not a queue.

Security asked for sub-processors. Show the list.

— No tickets. No tier-1 maze. A founder countersigns the DPA.

Send the DPA →
Need the list in a procurement template? Reply with the form and we mirror this table into it.
— For procurement reviewers

Enterprise disclosure

The full data-processing addendum (DPA) and our standard contract addendum are provided to enterprise customers and procurement reviewers on request. Email hi@slashed.pro with subject "DPA request" and we'll send the current sub-processor list, our DPA template, and the countersign option.