1. What a subprocessor is
When a customer sends its data through FireFunc — tickets, events from its tools, what its agents did — the customer is the controller of that data and SoftHawker LLC, which operates FireFunc, is its processor, as the Data Processing Addendum sets out. A subprocessor is a company we engage to handle that customer data for us, in providing FireFunc.
Amazon Web Services and Google handle data under their own data processing terms, which form part of their agreements with us. We remain responsible to our customers for how our subprocessors handle their data.
2. Our subprocessors
| Subprocessor | What it does for FireFunc | Where |
|---|---|---|
| Amazon Web Services, Inc. | Hosts FireFunc: the website, the API, the workers, the database, sign-in, secrets and logs. | United States — the us-east-1 region, in Northern Virginia |
| Google LLC (Google Workspace) | Hosts FireFunc’s email: the requests, security reports and questionnaires people send to admin@firefunc.com, and the early access requests and alerts sent to the team. | Google’s data centers; Google Workspace does not promise one region |
These are the AWS services FireFunc uses, and the data each one handles. All of them run in us-east-1.
| AWS service | What it does | Data it handles |
|---|---|---|
| Amazon CloudFront | Serves firefunc.com and passes its requests to the API. | Requests in transit |
| Amazon API Gateway | The address the runner and engines reach the API at. | Requests in transit |
| AWS Lambda | Runs the API and the background workers. | All customer data, while it is processed |
| Amazon RDS for PostgreSQL | The database, encrypted at rest, with automated backups kept for 7 days. | All customer data FireFunc stores |
| Amazon SQS | Queues work between the API and the workers. | The details of each job, while it waits |
| Amazon S3 | Holds the files of the website and the staff console. | No customer data |
| Amazon Cognito | Signs people in: checks passwords and second factors. | Email addresses, what is needed to check a password, authenticator keys |
| Amazon SES | Sends the emails that confirm an address and reset a password. | Email addresses |
| Amazon SNS | Sends operational alerts and early access requests to the FireFunc team. | What an early access request contains |
| AWS Systems Manager Parameter Store and AWS Key Management Service | Keep secrets encrypted: the tokens for the tools you connect, and FireFunc’s own keys. | Tool tokens and credentials |
| Amazon CloudWatch | Operational logs, kept for 30 days, and the alarms that watch them. | Operational details and errors, with secrets removed from web addresses |
| Amazon ECS (Fargate) | Runs the task that applies changes to the database’s structure. | Stored data, when a change has to move it |
FireFunc does not take payments through its site yet, so no payment processor handles any data.
Google Workspace is on the list because what you email us at admin@firefunc.com — a request, a report, a questionnaire — can contain personal data. The service itself sends no customer data there.
3. Services you connect or run yourself
These are not FireFunc’s subprocessors. You choose each one, you hold the account with it, and data moves between it and FireFunc, or between it and your machines, because you directed it to. Its own terms and privacy policy govern what it does with the data, and your agreement with it is yours.
| Service | What moves, and whose account it uses |
|---|---|
| The tools you connect: GitHub, Jira, Linear, Sentry, Slack, Figma and Microsoft Teams | Tickets, messages, pull request and issue details, error reports and designs come to FireFunc from your account with each tool. FireFunc sends each tool what you set up — notifications, and what your agents are granted to write — with that same account. |
| MCP servers your organization adds, or a machine of yours is signed in to | An agent granted one reaches it during a run, with the credential your organization entered or signed in with, or with the machine’s own sign-in. |
| Webhooks | Your systems send events to your FireFunc webhook addresses, and FireFunc sends events to the addresses you subscribe. |
| The AI engines on your machines: Claude Code, Codex, Copilot CLI, Gemini CLI, Cursor CLI and Antigravity | Each runs on your machine, signed in to your own account with its vendor. FireFunc sends your machine the brief a run starts from; what the engine then sends its vendor goes from your machine, under your account. |
| The AI engines that run in their vendor’s cloud: GitHub Copilot’s coding agent, Cursor’s cloud agents and Claude Code routines | Used only if you choose one for an agent. FireFunc sends the vendor the task with the key or connection you gave it, and the vendor works on your repository in its own cloud, under your account. FireFunc keeps what the engine reports back. |
| Your machines | The computers you pair run the runner and the engines, and hold your code. They are yours, not FireFunc’s. |
4. Changes to this list
We tell customers at least 30 days before a new subprocessor begins to process customer data: by email to each organization’s owners, and on this page, where the date and version at the top change with the list.
To object to a new subprocessor, write to admin@firefunc.com within those 30 days. What follows an objection is set out in the Data Processing Addendum.
5. Contact
For any question about this list, write to admin@firefunc.com. How FireFunc protects the data these services handle is on the Security page.