AI processing and sub-processors
Last updated
Draft, pending legal review
This document is a working draft and has not yet been reviewed by counsel. It describes how showpath works today and may change before it is finalized. It is not legal advice. Questions: legal@showpath.dev.
showpath relies on third-party infrastructure and AI models to do its job. This page lists who they are, what each one sees, and the defaults that limit what is kept. It reflects the current product and will change as it does.
1. Where AI is used
- Transcription: recorded audio is sent to a speech-to-text model.
- Badge extraction: a badge photo is sent to a vision model that reads the name, title, company and contact details.
- Notes and matching: transcripts are turned into notes and linked to an event, account, opportunity and contact.
- Enrichment: company details may be read from the company’s public website; paid contact enrichment runs only if the customer enables it.
- Follow-ups: models draft emails, tasks and calendar holds. Drafts wait for the User’s approval unless the User turns on automatic sending (off by default).
- Assistant: the in-app assistant sends the conversation and the records it looks up to a fast text model (by default DeepSeek, with Alibaba Qwen as fallback). It reads and changes data only through the same permission checks as the User it acts for, and it cannot send emails, add calendar events or run paid data lookups without the User’s tap.
AI output can be wrong: names misheard, notes incomplete, a conversation matched to the wrong record, or a drafted message that misstates something. Customers are responsible for reviewing it (see our Terms).
2. Infrastructure sub-processors
| Sub-processor | Purpose | Data | Location |
|---|---|---|---|
| Vercel Inc. | Hosting, serverless functions and background workflows; Vercel Blob object storage for audio and, if kept, badge photos; Vercel AI Gateway, which routes every AI model call listed below. | All Customer Data in transit; audio and badge photos at rest in Blob storage. | United States |
| Resend | Transactional email: address confirmation, workspace invitations and join requests. | Names and email addresses of Users and invitees, and the workspace name. | United States |
| Logo.dev | Company logos shown next to accounts and opportunities. The app loads each logo from Logo.dev’s image service, and showpath looks up once per company whether a logo exists. | Company website domains (for example acme.com), and the viewer’s IP address and browser details when a logo image loads. No contact, prospect or conversation data. | United States |
| Neon | Managed Postgres database. | Account data, transcripts, notes, badge text, contacts, companies, follow-up drafts, settings, audit log. | United States (AWS us-east-1) |
3. AI model providers
Every model call goes through Vercel AI Gateway. showpath code names a task (for example “transcribe” or “write notes”), not a model, and each task has a primary model and a fallback. The current defaults come from the following model makers:
| Model maker | Used for | Data sent |
|---|---|---|
| Microsoft (MAI) | Transcription of recorded audio and voice commands. | Audio. |
| Mistral (Voxtral) | Transcription (fallback). | Audio. |
| Google (Gemini) | Badge-photo extraction. | Badge images. |
| OpenAI | Badge-photo extraction (fallback). Embeddings for search are configured but not yet in use. | Badge images. |
| typesafe-ai (Jev) | Typed decisions, such as which account a conversation belongs to and its sales stage. | Excerpts of transcripts, notes and record names. |
| DeepSeek | The in-app assistant, notes, conversation facts, company profiles and follow-up drafts. | Transcripts, notes, contact and company details, company profile, User writing rules. |
| Alibaba Cloud (Qwen) | Fallback for the assistant, notes and drafts. | Transcripts, notes, contact and company details. |
| Exa | Web search for event research, run through Vercel AI Gateway: finds a show’s official site, dates, venue and links. | Event names, dates and places the team entered. No contact, prospect or conversation data. |
| Cohere | Re-ranking search results (configured, not yet in use). | None today; short text snippets once enabled. |
- Inference location varies. The Gateway may serve a model from its maker or from a hosting provider, and some of these models are operated by companies based, or serving requests, outside the United States (for example Alibaba Cloud and DeepSeek).
- Badge photos are only sent to US-based providers (Google, OpenAI).
- Language. Audio and text are processed in the language spoken or written; transcription models detect the language automatically.
- Zero data retention, on by default. We enable ZDR for every customer and User: the Gateway routes each request only to providers with a zero-data-retention agreement and refuses it otherwise. No workspace or User setting can turn it off. Models that retain data are not used.
- Defaults are provisional. The text models are being evaluated and may change; we will update this page when they do.
- No training by showpath. showpath does not train models on Customer Data. Each provider’s handling of requests is governed by its terms with the Gateway.
4. Optional providers the customer turns on
These are not used unless the customer or User enables them. Each provider’s own terms and privacy policy govern the data it holds and returns.
| Provider | When | Data |
|---|---|---|
| FullEnrich | Only if the customer enables paid enrichment. | Contact name, company name or domain, LinkedIn URL. Returns work email, phone, title, profile URL, and company details. |
| Clay | Only if the customer enables paid enrichment. | Same lookup fields as above, sent to a Clay table; Clay posts the result back to showpath. |
| Google or Microsoft | Only if a User signs in with, or connects, their Google or Microsoft account. | Sign-in identity; follow-up emails and calendar invitations the User approves or auto-sends. |
5. Retention defaults
- Audio: deleted after transcription by default; held at most 24 hours if processing has to be retried. A customer may choose to keep audio for a set period.
- Badge photos: discarded after extraction by default, under the same optional retention policy.
- Transcripts, notes and records: kept in the customer’s workspace until deleted by the customer or on request.
6. Recording consent
No audio is stored or transcribed unless the recording User has accepted showpath’s recording attestation, which records that they will only record where they have, or do not need, everyone’s consent. The customer remains responsible for consent and notice under the laws that apply where each conversation takes place.
7. Changes to this list
We will update this page before adding or replacing a sub-processor that handles Customer Data, and give customers reasonable notice (we aim for 30 days) and a chance to object. To be notified, email legal@showpath.dev.