Last updated 11 September 2026
Sub-processors
Third parties that process customer data on our behalf. We give workspace owners 30 days’ notice by email before adding or replacing one; owners may object on reasonable data-protection grounds, in which case we will work in good faith to find an alternative or the customer may terminate the affected service. Hosting and storage entries reflect the deployment described in our documentation; if you self-host or we change providers, this page is updated first.
| Provider | Purpose | Location | Data | Transfer safeguard |
|---|---|---|---|---|
| Fly.io, Inc. | Application hosting and persistent storage | USA (Dallas region) | All service data, encrypted at rest | SCCs; DPA |
| Cloudflare, Inc. (R2) | Object storage for rendered media and encrypted database replicas | USA | Renders, encrypted DB replicas | DPF-certified; SCCs |
| Anthropic, PBC | AI model provider (analysis, drafting) | USA | Listing text, public reviews, drafts — no training on customer content | SCCs; commercial API terms |
| Resend, Inc. | Transactional email | USA | Email address, sign-in links, alerts | SCCs; DPA |
| Functional Software, Inc. (Sentry) | Error tracking | USA | Error metadata, request ids (secrets and PII scrubbed) | DPF-certified; SCCs |
| HeyGen Technology Inc. (if video generation is enabled) | Avatar video generation | USA | Reel scripts | SCCs; DPA |
The advertising and social platforms you connect (Google, Meta, TikTok, LinkedIn, Apple) are independent controllers acting under their own terms, not sub-processors.