Mosaic Subprocessors
Last updated: 5 October 2026
This page lists every third party that processes Customer Content or personal information on behalf of Campainless Pty Ltd in providing Mosaic, what each one does, and the data-handling terms it operates under. It is the operational companion to Section 6 of our Privacy Policy and the disclosure our APP 8 (cross-border) obligations rest on.
Two commitments come with this page:
- It is maintained, not decorative. Each entry below carries the date we last verified its claims against the provider's own published terms.
- We keep you informed. We keep this page current; material additions are notified to organisation administrators, and you can raise an objection with us at the contact address at any time.
Infrastructure
| Subprocessor | Purpose | Location | Data exposure | Terms verified |
|---|---|---|---|---|
| Amazon Web Services | All hosting: application, database, queues; the isolated AI agent execution environment; log storage | Australia and/or United States (current: Australia) | All Service data at rest, encrypted | 2026-08-13 |
| Stripe | Payment processing | US | Billing contact and transaction data only; never Customer Content; card details go to Stripe directly and never touch our systems | 2026-08-13 |
| Slack Technologies | The messaging surface the coworker operates in | US | Messages, workspace and channel metadata, and user profile information the app can access | 2026-08-13 |
| Composio | Connector platform: the authenticated bridge between Mosaic and the tools your organisation connects | US | Data in scope of each connection your organisation authorises, in transit | 2026-08-13 |
| Pipedream | Connector platform: additional tool connections, where your organisation uses them | US | Data in scope of each connection your organisation authorises, in transit | 2026-08-13 |
| Postmark (ActiveCampaign, LLC) | Transactional email: invites, password resets, notifications | US | Work email addresses and the content of those emails | 2026-08-13 |
AI model providers
Customer Content is sent to these hosts per-request for processing and is not used to train their models (contractual default in every case; we opt into no data-sharing programme). "Retention" is the host's own published window for API content.
The list below is generated from the routing table the Service actually dispatches on, not maintained by hand beside it — so it is the same set of hosts your content reaches, on the day you read it, and a host appears here when we start routing to it and drops off when we stop.
One acceptance covers all of them. The terms your organisation accepted at signup cover every host on this page, which is why turning a model on in-product is a single administrator decision and not a second consent dialog: the processing was disclosed before any of it happened, rather than at the moment you were trying to do something else. Some models are on for every organisation because the Service itself is built on them; the rest an administrator switches on. Either way the host is one of the companies below, under the terms below.
| Processing host | Models it serves | Trains on your content | Retention | Processed in |
|---|---|---|---|---|
| Anthropic | Claude Fable 5.1, Claude Haiku 4.5, Claude Opus 4.8, Claude Opus 5, Claude Opus 5.5, Claude Sonnet 5.5 | No | Not retained after the request, apart from an abuse-monitoring window: 30 days, reviewed by a human only if a request is flagged | United States |
| Baseten | GLM-5.3-Flash | No | Not retained after the request | United States |
| DeepInfra | DeepSeek V4.1 Flash, MiniMax-M3 | No | Not retained after the request | United States |
| Fireworks AI | Kimi K3 | No | Not retained after the request | United States |
| Google Cloud | Gemini 3.8 Flash | No | Not retained after the request | Multiple regions - not pinned to one country |
| OpenAI | GPT-5.6 Luna, GPT-5.6 Sol, GPT-5.6 Terra, GPT-6 Astra, GPT-6 Luna, GPT-6 Sol | No | Not retained after the request, apart from an abuse-monitoring window: 30 days, reviewed by authorised staff only if a request is flagged | United States |
| SiliconFlow | Qwen3.8-2.4T-A95B | No | Not retained after the request | United States |
| xAI | Grok 4.6, Grok 4.7 | No | Not retained after the request | United States |
We route to a host only where we have verified, against that company's own published terms, that it neither trains on your content nor retains it after the request. A model whose only available host fails that test is not offered at any price, and the verification record — with sources and the date each claim was checked — is available to customers on request.
Where processing happens is a separate question from what is kept. Zero retention says your content is not stored; jurisdiction says whose courts and whose disclosure law can reach the machine that processed it. Both are stated per host above, and neither is allowed to stand in for the other. Where a host is not pinned to a single country, the table says so rather than naming the most reassuring one.
Routing broker. Several hosts above are reached through OpenRouter (US), which selects nothing on its own: each route is pinned to one named host on a zero-retention endpoint, with broker-side fallback off, so a starved host is a failed request rather than a quiet re-route to somewhere unverified. OpenRouter does not run models itself and its own content-use programme is an opt-in we leave off.
What is deliberately absent
- No advertising processors or trackers. Product analytics are first-party (identifiers, counts, and outcomes — never document bodies, message text, or form-field values).
- No data brokers, enrichment, or resale relationships of any kind.
- No AI provider with training rights over Customer Content is eligible to serve requests, whatever its price.
Questions or objections: privacy@mosaicailab.ai