Arlo

Sub-processors

Who we trust
with your data.

Effective May 8, 2026

Arlo uses a small set of trusted vendors to operate the service. Each one is bound by a contract that limits what they can do with your data. This page is the full list.

If we add or change a sub-processor in a way that affects how your data is handled, we will update this page and notify customers on paid plans by email at least 30 days before the change takes effect, except where speed matters for security.

Infrastructure

  • Cloudflare(United States, global edge). Hosts the Arlo web app, runs our background workers, and stores attachments in R2. All traffic to Arlo terminates at Cloudflare’s edge.
  • Neon (United States). Managed PostgreSQL database. Stores your account data, encrypted email content during the retention window, contacts, memory entries, and narrative.

Connected service ingestion

  • Nylas (United States). Reads email and calendar from Gmail and Google Calendar on your behalf, with the OAuth scope you granted at connect time. We pull from Nylas, encrypt, and store.

AI

  • Cloudflare Workers AI(global edge). Hosts the gpt-oss models (OpenAI’s open-weights model family) that handle routine AI reasoning over your content. Inference runs inside Cloudflare’s network, the same network where Arlo’s web app and workers already live. This is the default path for all AI features: email triage, briefings, draft replies, narrative refresh, memory extraction, and contact structuring.
  • OpenAI (United States). Used only as a fallback when Workers AI is unavailable. Bound by our API agreement, which prohibits OpenAI from training general-purpose models on content sent to their API.

Communications

  • Resend (United States). Sends transactional email from Arlo to you (welcome, alerts, billing notices). Resend handles the email we send, not the email we read.
  • Twilio (United States). Powers the WhatsApp surface for Arlo, used to deliver briefings and accept on-the-go messages.

Billing

  • Stripe(United States). Processes payments. Card details are handled by Stripe, not stored on Arlo’s servers.

Enrichment

  • Andi Search (United States). Searches public web information about people you correspond with.
  • Perplexity (United States). Generates structured summaries from public sources for the same purpose.

Sub-processor change notifications

Email privacy@arlo.fyi to be added to the notification list for sub-processor changes. Customers on paid plans are added automatically.

Read more

For the plain-English explainer of how Arlo handles your data, see How Arlo Handles Your Data. For the formal policy, see Privacy Policy.