Subprocessors handle information on Helmsted’s behalf for the services identified below, under required contractual protections. Retention depends on the service and configuration. Independently engaged professionals are separate recipients when serving their own client engagements. The DPA governs oversight, responsibility, and changes.
Providers
16 listed · ZDR marks Zero Data RetentionApplication delivery and AI request routing; request/response content and metadata.
Application and agent hosting; documents, context, outputs, and session information.
Configured compute and infrastructure; information depends on workload.
Database, authentication, and sessions; accounts, records, permissions, and audit information.
AI processing of submitted task information under the required no-training and zero-retention arrangement.
AI processing of submitted task information under the required no-training and zero-retention arrangement.
AI processing of submitted task information where enabled, under the required no-training and zero-retention arrangement.
AI processing of submitted task information under the required no-training and zero-retention arrangement.
Meeting capture where enabled; meeting audio, video, transcripts, and related metadata, configured for no media retention by the provider.
Execution environments; documents and intermediate outputs in active or paused workflows.
Object storage and delivery; documents and generated artifacts.
Configured feed staging and related infrastructure.
Workflow orchestration; event payloads and execution records.
Email delivery; recipient details, message content, and delivery records.
Authorized account connections and financial information under applicable consents and provider terms. Helmsted does not store financial-institution passwords through this service.
Public-web retrieval; submitted URLs and queries. Client information requires authorization for that processing.
Notes for reviewing firms
Listed primary service locations are not an exclusive processing or support residency guarantee. Processing remains subject to the governing DPA.
AI processing follows the required no-training and zero-retention arrangements. Helmsted’s stored records, paused sandboxes and workflow histories have separate retention treatment.
This versioned list is Exhibit A of the DPA. An Order-date copy accompanies the executed Order; later changes follow the DPA. Contact security@helmsted.ai.
Changelog
1.5 (September 19, 2026): Added Recall.ai (meeting capture) and TypeSafe AI, Inc. (AI processing). Vercel description now includes AI request routing. Change terms follow DPA v1.7.
1.4 (September 11, 2026): Clarifies service scope and retention; preserves the 14-provider inventory and governing amendment requirements.
1.3 (August 25, 2026): Added Amazon Web Services for secure staging of custodial data feeds. Current 14-vendor list in effect.
1.2 (July 24, 2026): 13-vendor list in effect.
1.1 (June 27, 2026): Data Processing Addendum updated to the 13-vendor list.
1.0 (April 27, 2026): First published list (9 vendors). Fly.io was later replaced by Render Services. The Anthropic arrangement was upgraded from an enterprise no-training agreement to Zero Data Retention.