Legal / Trust
Subprocessors
FeatureFactory engages the third-party subprocessors listed below to deliver the service. This page is kept current as our vendor list changes.
Code diffs are sent to AI providers
To score pull requests and generate AI recommendations, FeatureFactory sends pull request diffs and code content to Anthropic's API. This is the core mechanism of the AI scoring feature. If your organization has restrictions on sending source code to third-party AI providers, please review Anthropic's data processing agreement and our DPA before connecting repositories.
Embeddings (semantic search) are generated via OpenAI's API using signal text and PR descriptions - not raw code diffs.
Both providers offer zero data-retention API agreements for enterprise customers. Contact us at privacy@featurefactory.com to discuss DPA options.
Current Subprocessors
Last updated: July 2026
| Vendor | Purpose & Data |
|---|---|
| Anthropic, PBC | AI analysis - PR diff scoring, code quality assessment, work-order generation. Code diffs and PR content are sent to Anthropic's API to produce AI scores and recommendations. Data shared: Pull request diffs, commit messages, code snippets, PR descriptions |
| OpenAI, LLC | Text embeddings - converting signals and content into vector representations for semantic search and similarity matching. Data shared: Signal text, commit messages, PR descriptions (no raw code diffs) |
| Stripe, Inc. | Payment processing and subscription billing. Data shared: Billing contact name, email, payment method details (card data handled directly by Stripe) |
| GitHub, Inc. (Microsoft) | Source code integration - reading pull requests, commits, and repository metadata via the GitHub API on behalf of connected teams. Data shared: Pull request metadata, commit data, repository names, contributor identifiers |
| Amazon Web Services, Inc. | Cloud infrastructure hosting - compute, storage, and managed database services for the FeatureFactory application. Data shared: All application data (stored at rest in the EU or US region per your account configuration) |
| Cloudflare, Inc. | DDoS protection, CDN, and DNS services. Data shared: IP addresses, request metadata (no application payload data) |
| Postmark (ActiveCampaign) | Transactional email delivery - account notifications, billing receipts, and alert emails. Data shared: Recipient email address, email subject and body |
Data Processing Agreement
Enterprise customers may request a signed DPA covering the subprocessors above. Email privacy@featurefactory.com with your company name and we will respond within 2 business days.
FeatureFactory will notify customers via email at least 14 days before adding or replacing a subprocessor that processes personal data or code content.