To support Runway Financial, Inc. (“Runway”) in delivering the cfo.ai agentic FP&A platform Services, Runway engages service providers and subprocessors to assist with data processing activities on behalf of Runway’s customers as defined in our Standard Terms and Conditions and Data Processing Agreement.

What is a subprocessor?

When Runway engages third party service providers in our capacity as a data processor for our customers’ personal data, the General Data Protection Regulation (“GDPR”) and other global privacy frameworks call these third-party service providers subprocessors. Subprocessors are service providers who have or potentially will have access to or process personal data that Runway processes for, and on behalf of, Runway’s customers.

This page outlines the types of service providers and subprocessors we utilize, where they are located, and a description of the work they carry out.

Due diligence

Before engaging any service provider (including subprocessors), we perform due diligence, including vendor security assessments. Our service providers are subject to contract terms designed to ensure that these service providers process personal data only for the purposes of providing services to Runway and in accordance with our commitments to customers and applicable data protection laws.

List of subprocessors

Infrastructure and data storage

Core infrastructure providers that store and process customer data.

Snowflake Inc. · United States

Cloud data warehouse for storing and processing customer integration data

Customer integration data including HRIS data (employee information), CRM data (customer contacts, contracts), accounting data (financial records), and customer-uploaded spreadsheet data

Google Cloud Platform · United States

Cloud infrastructure provider for Postgres database hosting and backend API services

Customer data, user data, and application data

Vercel Inc. · United States

Frontend application hosting and deployment platform

User interaction data and session information

Google Firebase · United States

User authentication and credential storage

User authentication credentials and user names

Elastic Search · United States

Index and search application data

Customer data, user data, and application data

Cloudflare, Inc. · United States

DNS hosting, CDN, DDoS protection, and traffic proxying for cfo.ai

User IP addresses, HTTP request metadata, and web traffic data processed in transit

Altinity, Inc. · United States

Managed ClickHouse analytics database powering model calculations, hosted within Runway’s cloud environment

Customer financial model data and calculation data (segment and table computations)

Neon · United States

Postgres database for the cfo.ai website

Business contact details submitted through the website, sign-up and privacy requests, consent records, and website traffic and performance data

AI services

Services that process customer inputs and related context to power AI features when customers use them.

OpenAI · United States

AI model inference and realtime assistant/explanation features

Customer prompts, uploaded files/attachments, relevant customer data context included in AI requests, and generated outputs, when customers use AI features

Anthropic · United States

AI model inference and realtime assistant/explanation features

Customer prompts, uploaded files/attachments, relevant customer data context included in AI requests, and generated outputs, when customers use AI features

E2B (FOUNDRYLABS, Inc.) · United States

Secure cloud sandbox for running and validating AI-generated code and commands (including a headless browser) for AI features

AI-generated code and any customer data context included in AI requests when executed in the sandbox, when customers use AI features

Hindsight (Vectorize AI Inc.) · United States

Persistent memory and context storage for AI assistant features

AI assistant memory including user preferences and org- and user-scoped context derived from customer interactions, keyed by org and user identifiers

Data integration services

Services that import customer data when customers actively opt into integrations.

Fivetran Inc. · United States

Data pipeline service for importing customer data from various sources

HRIS data (employee information), CRM data (customer contacts, contracts), accounting data (financial records), dynamic imported data, when customers opt in

Merge.dev · United States

Unified API platform for importing customer data from various sources

HRIS data (employee information), CRM data (customer contacts, contracts), accounting data (financial records), dynamic imported data, when customers opt in

Workato, Inc. · United States

Integration platform for importing customer data from various sources

HRIS data (employee information), CRM data (customer contacts, contracts), accounting data (financial records), dynamic imported data, when customers opt in

Analytics and monitoring

Services that collect and analyze user behavior and system performance data.

Datadog, Inc. · United States

Backend performance monitoring and system observability

Backend performance data, system logs, and potentially user email addresses for error tracking

Sentry · United States

Bug tracking and error monitoring

Error logs, debugging information, and potentially user email addresses

Niteshift, Inc. · United States

AI coding-agent platform used by engineering to investigate incidents and generate fixes

Source code, plus engineering logs and traces that may contain org, user, and session identifiers

GitHub, Inc. · United States

Source code hosting, version control, and CI/CD for engineering

Source code repositories, plus engineering logs, issues, and CI metadata that may contain org, user, and session identifiers

Rootly, Inc. · United States

Incident management and response for engineering

Incident metadata and engineering timelines that may contain org, user, and session identifiers

PostHog, Inc. · United States

Product analytics, session replay, and event instrumentation

Product usage events, user identifiers, and session replay recordings of in-app and website user interactions

Customer support and communications

Services used for customer relationship management and support.

HubSpot, Inc. · United States

Customer relationship management and support ticketing

Customer contact information, support tickets, CRM data, and communication history

Slack Technologies, Inc. · United States

Customer support communications and internal team collaboration

Customer communication data, support conversations, and user information shared in support channels

Google Workspace · United States

Email services and document collaboration with customers

Email communications, shared documents, spreadsheets that may contain customer data, and collaboration data

DocuSign, Inc. · United States

eSignatures

Business User data

Pylon · United States

Customer support communications

Support tickets, account history, and user information shared in support channels

Advertising and visitor identification

RB2B · United States

Identity resolution on the cfo.ai marketing website: matching an anonymous visit to a named individual and their employer, and reporting that match to Runway. Runs only while the marketing setting is on

IP address, device and browser details, pages viewed, and the identity RB2B resolves from them, including name, employer and professional contact details

Payment processing

Stripe, Inc. · United States

Payment processing and subscription management

Customer billing information, payment data, and transaction records

Data residency services

GDPR Local · United Kingdom

GDPR Article 27 EU/UK Representative services and data protection compliance support

EU and UK customer data that requires local representative services, data protection inquiries, and compliance documentation

Updates to this page

Due to the nature of our global business and the volume of customers, our business needs and service providers may change from time to time. For example, we may deprecate a service provider to consolidate and minimize our use of service providers. Similarly, we may add a service provider if we believe that doing so will enhance our ability to deliver our Services.

We will periodically update this page to reflect additions and removals to our list of service providers and subprocessors. Every earlier version of this page keeps a permanent address; they are listed on cfo.ai/legal. For more information on Runway’s privacy practices, please visit our Privacy Policy. If you have any questions regarding this page, please contact us at security@cfo.ai or through our support channels.

This version as a PDF: cfo.ai/subprocessors/2026-09-09.pdf.