Legal
Subprocessors
Last updated: May 7, 2026
We use a small set of third-party services ("subprocessors") that may process customer data on our behalf. Each subprocessor is bound by a data-processing agreement and handles data only on our documented instructions. We update this page when we add or remove a subprocessor.
Current subprocessors
| Subprocessor | Purpose | Data categories | Region | Privacy policy |
|---|---|---|---|---|
| Cloudflare | Edge compute (Workers), object storage (R2), database (D1), key-value store (KV), stateful coordination (Durable Objects), static hosting (Pages), bot protection (Turnstile) | Stream segments, account metadata, auth tokens, request logs | Global (edge) | cloudflare.com/privacypolicy |
| Clerk | User authentication, session management, team invitations, waitlist | Email address, display name, password hash, session cookies, IP address at sign-in, MFA factors | United States | clerk.com/legal/privacy |
| Stripe | Payment processing, subscription lifecycle, billing portal | Billing name, billing address, payment card metadata (card brand and last 4 digits — we never see full card numbers), subscription state | United States | stripe.com/privacy |
| Forward Email | Transactional email delivery (welcome, stream alerts, billing notices, trial reminders) | Recipient email address, display name (in email body) | United States | forwardemail.net/en/privacy |
How we evaluate subprocessors
We choose subprocessors based on:
- Strong security posture (SOC 2, ISO 27001, or equivalent independent attestation)
- Data-residency commitments aligned with our customers' needs
- Clear data-processing terms in their privacy policy or Data Processing Agreement (DPA)
Notification
If we add a new subprocessor, we will update this page and — for material changes — notify customers at least 30 days before the new subprocessor begins processing customer data. Notifications are sent by email to the account owner.
Services we do not use today
We do not currently use third-party services for analytics, error tracking, or advertising. If we add any in the future, they will appear in the table above first.
Questions
Privacy questions about our subprocessors: [email protected]. See our full Privacy Policy for how we handle data across all of these services.