For AI agents: a documentation index is available at the root level at /llms.txt. Append /llms.txt to any URL for a page-level index, or .md for the markdown version of any page.
Mythos Software, LLC uses the providers below to operate Mythos. Their role depends on the service and data involved. The Privacy Policy covers our controller activities; the Data Processing Agreement covers customer personal data processed on documented instructions.
Providers are identified by service name; their applicable contracting entities are defined in Mythos’s provider agreements. An infrastructure region describes the deployment, not a promise that all support, control-plane processing or downstream subprocessors stay in that country.
Core platform and customer-content processing
Provider
Purpose and data
Processing location
Provider terms
Supabase (Supabase Pte. Ltd.)
Authentication, Postgres and private storage: account information, project and collaboration content, credits, connection metadata and consented analytics records.
Mythos’s platform project is in Frankfurt, Germany (eu-central-1). Provider operations and subprocessors can involve other countries.
App, isolated build and connector runtime; the dedicated connector-gateway Cloud SQL database; managed secrets, operational logs and scheduling. Receives content needed for requests/builds, encrypted connection credentials, provider-response payloads and execution receipts, plus infrastructure metadata.
Main Cloud Run runtime and connector database: Frankfurt, Germany (europe-west3). Certain control-plane and operational processing can occur outside that region, including the United States.
Code-generation inference and optional planning, transcription, document extraction and requested image generation. Receives only the context needed for the selected feature. Mythos does not persist dictation audio or use customer project content to train its own models.
Processing under the applicable API account terms; Mythos does not promise EU-only inference or zero provider retention.
DNS/security proxy, private preview artifacts and source bundles, immutable published-build storage in R2, edge hosting and consent-controlled analytics transport. Receives private project/build content for storage, public published content and network request metadata; the bounded analytics event excludes raw IP and full user-agent values. Private preview/source objects are not exposed by the public-site Worker.
Global edge network and service infrastructure. No blanket EU-only storage or routing commitment.
Authentication and transactional email, including recipient, bounded collaboration context, action links and delivery events. No project source or provider credentials are intentionally included.
Sending region and storage residency differ. The provider documents US storage for account, email metadata, logs and API records even when sending through an EU region.
Hosted Checkout, Billing, customer portal, fraud prevention and financial compliance. Full card details are handled in Stripe’s hosted flow. Stripe can act as processor for certain merchant services and as an independent controller for its own payment and compliance activities. Privacy, DPA.
Fern (Birch Solutions, Inc. dba Fern)
Public documentation hosting at docs.mythos.new. Receives public documentation and ordinary visitor requests. Mythos does not send account sessions, private project content or connector credentials through documentation links. Privacy.
Services you connect
Your selected GitHub, Supabase and other connected-service accounts remain governed by your provider agreements. They are not all Mythos subprocessors merely because an integration exists. Authorizing an action can transmit the data required by that action to the selected provider.
Changes
For customer processing under our DPA, we give at least thirty days’ advance email or in-product notice of a new or replacement subprocessor, with the objection process described in that agreement. Publication here alone is not proof that individual notice was delivered. Urgent security or continuity changes follow the DPA’s specific exception.
