Website sub-processors
Last updated: 2026-08-08
This page lists the third parties that process personal data on Mithran's behalf when you use the mithran.ai website. It covers the website only.
It is not the product sub-processor list. The list that accompanies the customer Data Processing Agreement covers the Aegis and Forge products, and it is still in preparation. Mithran will publish it separately.
Current sub-processors
| Provider | What it does for us | What it processes | Where |
|---|---|---|---|
| Google Cloud (Google LLC) | Hosts the site, terminates TLS, stores the site bundle, and records service logs | Request metadata, including IP address, in Cloud Run request logs | United States |
| Resend | Delivers contact-form submissions to hello@mithran.ai as email |
Your name, work email, company, role, and message | United States |
| PostHog, Inc. | Website analytics, and only after you opt in | Page views, scroll depth, clicks, and performance events. The events carry no IP address, and the project is set to discard the connection address rather than store it. | United States, on Amazon Web Services (PostHog US Cloud) |
Website data is stored in the United States.
Two qualifications belong with that sentence. PostHog uses Cloudflare as its edge network, so requests may transit servers outside the United States on their way to storage. And Mithran's own staff work from Portugal, Spain, the UK, Israel, and the United States, so an enquiry sent through the contact form is read wherever the person answering it is.
Onward sub-processors
Each provider uses its own sub-processors. PostHog publishes its list at
posthog.com/subprocessors, and as of its 2026-06-12 update it names Amazon
Web Services, Wiz, PlanetScale, Modal Labs, and Cloudflare. Its data processing
agreement commits it to fourteen days notice of a change, and to an opportunity
to object.
Changes
Mithran updates this page when a provider is added or removed.
Before a provider that handles personal data goes live, it clears an internal review of what data it receives, how long it keeps it, who its own sub-processors are, and what its data protection terms say.