Mesy Sub-Processor List
Last updated: 17 August 2026 · Applies to Mesy (https://app.mesy.ai), operated by Majulah SG Pte Ltd (UEN 202129171K), 6 Ubi Road 1, #06-10, Wintech Centre, Singapore 408726.
Mesy uses the third-party providers listed below (“sub-processors”) to deliver the service. A sub-processor is a third party that may process personal data contained in your Mesy workspace (your CRM records, synced email and calendar content, files, chat messages) on our behalf and under our instructions.
For that data, Majulah SG Pte Ltd acts as a data intermediary (processor) under the Singapore Personal Data Protection Act 2012; you remain the organisation responsible for the data you put into Mesy. Our engagement of each sub-processor is governed by our Data Processing Agreement (DPA) with you.
Most sub-processors are located outside Singapore, so personal data is transferred out of Singapore. We transfer personal data abroad only where the recipient is bound to a standard of protection comparable to the PDPA, which we establish through each provider’s data processing agreement and standard contractual clauses (PDPA s.26).
Questions about this list: dpo@mesy.ai.
Sub-processors
| Provider | Entity | What it processes | Where it processes | Purpose |
|---|---|---|---|---|
| Supabase (PostgreSQL) | Supabase, Inc. (United States) | All workspace data: CRM records, notes, activities, tasks, synced email and calendar content, chat messages, account and user data | Singapore (ap-southeast-1) |
Primary database and system of record |
| Cloudflare R2 | Cloudflare, Inc. (United States) | Uploaded files, email attachments, captured images, WhatsApp media, cached chat images, and nightly database backup copies (all workspace data, kept 30 days) | Asia-Pacific (configured placement) | Object storage for file content and off-site backups |
| DigitalOcean | DigitalOcean, LLC (United States) | All personal data, processed by the application servers. Full database backup dumps are also retained on the host’s disk: the newest ten, and in any case anything younger than 14 days | Singapore (SGP1) | Application hosting and compute; on-box database backups |
| Anthropic (Claude) | Anthropic PBC (United States) | AI prompts and tool results where Anthropic is your workspace’s selected model (the default if none is chosen) or your configured image-extraction fallback: CRM record fields, names, email addresses, full email bodies, and image content such as business cards | United States for storage; inference may route through the provider’s global regions | AI assistant and image understanding |
| Google (Gemini API) | Google LLC (United States) | AI prompts and tool results as above, where Gemini is your workspace’s selected model or your configured image-extraction fallback, including email drafting (contact details, opportunity value and stage, linked organisation name, and the original email body up to 2,000 characters) | No region commitment from the provider; its terms permit processing wherever Google maintains facilities | AI assistant, image understanding, and email drafting |
| OpenAI | OpenAI, L.L.C. (United States) | Voice recordings for transcription are always sent to OpenAI, regardless of the model selected for your workspace; also AI prompts, tool results and image content where OpenAI is your selected model or your configured fallback | Not published by the provider; principally the United States | Voice transcription, AI assistant and image understanding |
| Google Gmail API | Google LLC (United States) | Email subjects, bodies, snippets, and sender and recipient names and addresses from mailboxes you connect | Provider’s global infrastructure | Mailbox synchronisation and sending |
| Google Calendar API | Google LLC (United States) | Event titles, descriptions, locations, times, and attendee names and email addresses | Provider’s global infrastructure | Calendar synchronisation |
| Microsoft Graph (Outlook mail, Outlook Calendar, Teams) | Microsoft Corporation (United States) | Outlook email subjects, bodies and addresses; calendar events and attendees; Teams chat messages and sender identities | Provider’s global infrastructure | Mail, calendar and chat synchronisation |
| Telegram Bot API | Telegram Messenger Inc. (British Virgin Islands; operating entity Telegram FZ-LLC, Dubai, UAE) | Messages you send to the Mesy bot, voice notes, and Telegram account identifiers (username, first name, chat ID) | Provider’s global infrastructure | Telegram channel for the AI assistant |
| Sentry | Functional Software, Inc., d/b/a Sentry (United States) | Application error events. Configured to exclude personal data; residual personal data may appear in exception messages | European Union | Error monitoring and diagnostics |
| Cloudflare Email Sending | Cloudflare, Inc. (United States) | Recipient name and email address for transactional email (password reset, workspace invitations) | Provider’s global infrastructure | Transactional email delivery |
| Tavily | AlphaAI Technologies Inc., d/b/a Tavily (United States) | Web-search query text submitted by the AI assistant, which may include the name of a person or company from your CRM | United States | Web research for the AI assistant |
| Google / Microsoft social sign-in | Google LLC / Microsoft Corporation (United States) | Sign-in identity: email address and profile name from the identity token | Provider’s global infrastructure | Optional single sign-on |
| OpenRouter | OpenRouter, Inc. (United States), routing onward to the model vendors DeepSeek and Tencent | AI prompts, tool results and content where an OpenRouter-hosted model is your workspace’s selected model: CRM record fields, full email bodies, calendar and chat content | United States platform; onward model hosts are restricted in our account settings to endpoints that neither train on nor retain request data | AI assistant, where selected |
| Better Stack | Better Stack, Inc. (United States) | Shipped application, access and security log lines, which include IP addresses; uptime and heartbeat check results | European Union | Uptime, heartbeat, log monitoring and short-term log retention |
| Meta (WhatsApp Business Platform) | Meta Platforms, Inc. (United States) | WhatsApp messages to and from your connected WhatsApp Business number: message text, sender phone numbers and profile names, timestamps, and media in transit | Meta’s global infrastructure | Delivery of inbound WhatsApp messages and sending of replies (Cloud API) |
Tavily web research, social sign-in, and the OpenRouter models are configuration-dependent: each receives data only where the feature is enabled or selected. Sentry and transactional email run for every workspace.
About the AI providers
AI features send workspace content to the providers listed above. Almost everything runs on the AI model your workspace administrator selects: co-pilot chat and sub-agents, email linking, the Telegram assistant, email drafting, capture enrichment, workflow AI steps, daily insights, and import auto-matching all use that model. Two flows are fixed regardless of your choice: voice transcription always uses OpenAI (Whisper), and web research, where configured, always uses Tavily. Business-card and image capture uses your selected model where it can process images, and otherwise falls back to your workspace’s separately configured fallback model, which may be a different provider.
Apart from web research, this description is derived from the same server registry that drives the “Powered by this model” panel in Mesy’s admin settings. If a feature’s routing changes, this page changes with it.
Mesy’s AI usage metering holds no prompt or response text, only token counts, model, latency and cost. AI conversation transcripts are stored in your workspace as your chat history, together with short redacted previews of each AI action, and are retained and deleted as the Privacy Policy describes. We do not train our own models on your data. What each provider may do with the data it receives is governed by our contracts with that provider.
Changes to this list
We update this page as our sub-processors change, and before adding or replacing a sub-processor that processes personal data. Where a change is material, for example a new sub-processor that processes your workspace content, we notify customers in accordance with the notice provisions of the Data Processing Agreement.