Loading…
Links last opened 28 October 2026. Record confirmed by a person on 2 October 2026. 4 recorded changes, listed below.
Kapa.ai contracts through Kapa.ai Inc., registered in United States. Transfers of personal data out of the EEA are covered by EU-US Data Privacy Framework (DPF). Its trust center is published at https://www.kapa.ai/security. Its customer data processing agreement, also called a data processing addendum, is published by Kapa.ai itself; the link is below. Its sub-processor list is published by Kapa.ai itself; the link is below. We open those pages every day — last on 28 October 2026 — and a person last went through this record on 2 October 2026.
A US certification scheme covered by an EU adequacy decision. Transfers to a certified US organisation need no further mechanism for the certified scope.
A ready row. Replace the purpose with what your client actually uses Kapa.ai for.
| Subprocessor | Legal entity | Country | Purpose | Transfer | DPA |
|---|---|---|---|---|---|
| Kapa.ai | Kapa.ai Inc. | US | AI providers | DPF | https://www.kapa.ai/content/dpa |
Changes we noticed on Kapa.ai's own pages, each with the page we saw it on. The vendor does not publish this, and neither does anyone else.
28 October 2026
Kapa.ai simplified its public search endpoint by removing optional parameters (job-to-be-done, source, and agent name) and now requires only the question parameter. This change reduces the amount of identifying information transmitted through the endpoint and may affect how data is logged or tracked when the API is called.
Seen on https://www.kapa.ai/content/dpa
27 October 2026
Kapa.ai added four new subprocessors as of October 2026: Modal Labs, Inc. (US/EU), Braintrust Data, Inc. (AI Monitoring, US/EU), TypeSafe AI, Inc., and Pylon Labs, Inc. (Customer Support, US/EU). You should update your records of processing and subprocessor lists to reflect these additions.
22 October 2026
Kapa.ai added documentation about a public search endpoint that processes questions and job context as query parameters without authentication. This matters for the DPA because it describes a data processing activity where user questions and optional context are sent to Kapa's servers, which should be reflected in the record of processing activities.
Seen on https://www.kapa.ai/content/dpa
3 October 2026
We recorded changes to the transfer mechanism, the UK transfer mechanism.
Enter your website: each service it loads, what it is for and links to its own DPA, in a minute or two. No sign-up.
Worked out from the registry and what we have written: the country this vendor contracts from, the guides that answer the question this page raises, and the rest of the registry.
Six of them. All ai providers in the registry · others that transfer the same way.