Legal

Subprocessors

Version 2026-10-04

Laravel Cloud (AWS)

Purpose: Application hosting, database, queues, and file storage for the hosted product.

Data: All customer data the gateway holds at rest and in transit.

Stripe

Purpose: Billing and subscription management.

Data: Billing contact details and payment data -- card data is handled by Stripe-hosted elements/checkout and never touches gateway servers directly.

Mistral

Purpose: Auto-mode LLM screening of tool-call arguments (optional, off by default -- see SECURITY.md "Auto-mode screening (LLM guardrail)").

Data: A locally-redacted, tail-truncated window of tool-call arguments and recent conversation, sent only when an account has auto-mode screening enabled.

GitHub

Purpose: Distribution of the mcp-gateway-agent and Outpost (outpostd) release binaries.

Data: None -- release artifacts only, no customer data.

Pending owner confirmation

Two further data flows are operator/owner-configured per deployment rather than a fixed subprocessor, so no vendor name is stated here: the audit-stream export destination (set by your own operator) and, for the hosted product specifically, the transactional-mail provider and any outbound-tracing (OpenTelemetry) endpoint. Confirm these with the owner before relying on this page as exhaustive.