Endstack procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “ Your container runs on AWS infrastructure in the United States (us-west-2 region). If you are located outside the United States, your data will be transferred to and processed in the United States. We rely on standard contractual clauses and provider compliance frameworks (e.g., AWS GDPR Data Processing Addendum) to ensure adequate data protection for international transfers.” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ We may suspend or terminate your access to the Service if you violate these Terms, if required by law, or if we discontinue the Service. Where practical, we will provide advance notice and an opportunity to export your data before termination.” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ You may stop using the Service and request account deletion at any time by contacting support@endstack.com .” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Account information Retained while your account is active. Deleted upon account deletion request, subject to legal retention requirements. Instance metadata Retained while your instance exists. Cleaned up after account deletion. Container contents Retained on your persistent storage while your account is active. After account termination, container data is deleted after a reasonable grace period. AI conversations Stored locally in your container. We do not retain copies. AI providers may retain data per their own policies (we opt out where supported). Server logs Operational logs (e.g., API request metadata, error logs) may be retained for up to 90 days for debugging and security purposes. These logs do not contain the contents of your files or conversations. ” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Delete your account and associated data — contact support@endstack.com ” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Upon termination, your right to access the Service ceases. We may delete your container and its contents after a reasonable retention period following termination. Account metadata may be retained as required for legal, regulatory, or legitimate business purposes.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We only send data to AI providers when you actively use the AI agent. If you do not use the agent, no data is sent to these providers.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Desktop context (e.g., open applications, current working directory)” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Amazon Web Services (AWS) Cloud infrastructure (compute, storage, networking) Your container and its contents run on AWS EC2 instances with EBS storage in the us-west-2 region. AWS processes data as a sub-processor under their terms. Supabase Authentication and account database Account info, instance metadata, team data Google OAuth identity provider Name, email, avatar (during sign-in flow) Vercel Hosts our landing page and web application Standard web request data (IP address, browser headers) for the landing site Resend / Amazon SES Email delivery Email address and email content for transactional emails ” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ When you use the AI agent, your conversation messages and relevant context are sent to third-party AI model providers for inference. We currently use:” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Important: We set store: false on OpenAI API requests where supported, opting out of server-side data retention by the provider. However, AI providers may process your data according to their own privacy policies:” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ When you interact with the AI agent, the following may be sent to AI model providers:” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ OpenAI — for chat, reasoning, code assistance, vision (image understanding), and image generation” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ We do not share the contents of your container with third parties, except as described in Section 4.1 when you actively use the AI agent” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ When you use the built-in AI agent, your messages and related context are sent to third-party AI providers for processing:” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ OpenAI Conversation messages, system instructions, file contents you ask the agent to read, images you ask it to analyze Chat, reasoning, code assistance, image generation, vision ” | Captured 2026-07-20Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ Team plans allow multiple users to access a shared desktop environment. The team administrator manages membership, roles, and permissions.” | Captured 2026-07-20Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ Each user on a team plan has their own Linux user account within the shared container, providing a degree of user-level isolation. However, shared desktops inherently involve shared resources, and users should exercise judgment about what data they store in shared environments.” | Captured 2026-07-20Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ In shared desktop environments, all team members may have access to shared files and resources. The team administrator is responsible for managing access controls and ensuring appropriate use by team members.” | Captured 2026-07-20Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ We offer Individual plans and Team plans. Enterprise plans may be offered in the future. Plan details, pricing, features, and usage limits are described on our website and may change over time.” | Captured 2026-07-20Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.