ATTRIBUT uses a fixed, published list of subprocessors — Google Cloud Platform, Cloudflare, Clerk, AWS SES, Sentry, Intercom, GitHub, and Google Analytics — and nothing else touches your data. A subprocessor is any third party that processes data on ATTRIBUT's behalf; the table below shows exactly what each one is used for.

ATTRIBUT runs no servers of its own — the entire stack runs on these managed providers, each scoped to a specific job.

This list was last updated 2026-07-01. If it changes, ATTRIBUT posts the update here before the change takes effect.

Your coding work is never sent to any AI model provider. ATTRIBUT's local collector only reports metadata about a coding session — things like token counts, tool-usage counts, line-change counts, timing, model name, branch, commit SHA, repo path, and session title. It never transmits your source code, file contents, diffs, prompts, or the AI's responses.

ATTRIBUT uses an AI model in exactly one place: when you write a product feedback request, an optional assistant turns your text into a structured title and description. That runs on Google Vertex AI (part of the Google Cloud Platform listed above), it receives only the feedback text you type — never your code, prompts, or sessions — and under Google Cloud's terms that text is not used to train Google's models. If you don't use that feedback box, no AI model ever runs on your data.

ATTRIBUT collects metrics about how work happened, not the work itself. Holding less data means fewer subprocessors are needed to handle it, and less exposure if any one of them has a problem.

If you have questions about any subprocessor on this list, or need a Data Processing Agreement (DPA), contact ATTRIBUT's security team. They read every request.