List of Subprocessors
We work with trusted third-party service providers (subprocessors) to deliver our services. This page lists all subprocessors that may process your personal data.
Last updated: October 14, 2026
Current Subprocessors
All subprocessors are required to maintain appropriate data protection standards and are bound by data processing agreements that include:
- Commitment to GDPR compliance
- Appropriate technical and organizational measures
- Restrictions on data use and access
- Data breach notification procedures
- Standard Contractual Clauses (SCCs) for international transfers
Amazon Web Services (AWS)
Ireland (EU)Purpose: Cloud hosting, compute services, and data storage infrastructure
Data Types: All platform data, user content, application data
Stripe
Ireland (EU)Purpose: Payment processing and subscription management
Data Types: Payment information, billing data, transaction records
Hasura
Germany (EU)Purpose: GraphQL API layer and real-time data synchronization
Data Types: Application data, user queries, metadata
Vercel
Germany (EU)Purpose: Frontend hosting, content delivery network, and AI Gateway (routes AI requests to the model providers listed here)
Data Types: Static assets, website content, usage analytics, AI prompts and responses routed through AI Gateway
Neon
Germany (EU)Purpose: PostgreSQL database hosting and management
Data Types: Application database, user data, content metadata
ClickHouse Cloud
Germany (EU)Purpose: Analytics database and data warehousing
Data Types: Usage analytics, performance metrics, aggregated data
Brevo
France (EU)Purpose: Newsletter subscription management and email marketing delivery, including consent records and unsubscribe handling
Data Types: Email address, subscription status, consent date, signup source
Notion
USA (SCCs)Purpose: Internal CRM — mirrors newsletter contacts for customer relationship management
Data Types: Email address, newsletter subscription status and dates
Clerk
USA (EU-US DPF)Purpose: User authentication, sign-in, and account management
Data Types: Name, email address, hashed password, profile photo (when signing in with a third-party account), session and device information
PostHog
Germany (EU)Purpose: Product analytics, session recordings, and error tracking to understand and improve how our Services are used
Data Types: Usage events, pages visited, device and browser information, session recordings (which may include content you enter or view), and for signed-in users an account identifier and email address. IP addresses are anonymized
OpenAI
USAPurpose: AI model provider for the AI assistant
Data Types: Prompts, conversation history, and data you upload or reference in AI conversations
Microsoft Azure
USAPurpose: Backup hosting of OpenAI models for the AI assistant
Data Types: Prompts, conversation history, and data you upload or reference in AI conversations
Cerebras
USAPurpose: AI model provider for AI features
Data Types: Prompts, conversation history, and data you upload or reference in AI conversations
Fireworks AI
USAPurpose: Backup AI model hosting for AI recommendations
Data Types: Prompts, conversation history, and data you upload or reference in AI conversations
Baseten
USAPurpose: Backup AI model hosting for AI recommendations
Data Types: Prompts, conversation history, and data you upload or reference in AI conversations
Anthropic
USAPurpose: AI model used to correct malformed AI tool requests
Data Types: Prompts, conversation history, and data you upload or reference in AI conversations
Langfuse
Ireland (EU)Purpose: Monitoring and quality review of AI features
Data Types: Prompts and AI responses, data you upload or reference in AI conversations, account and conversation identifiers, feedback you give on AI answers
Data Protection Safeguards
For subprocessors located outside the European Economic Area (EEA), we ensure appropriate safeguards are in place:
- Standard Contractual Clauses (SCCs): EU-approved contract terms ensuring data protection
- Adequacy Decisions: Where available, we rely on European Commission adequacy decisions
- Additional Safeguards: Technical measures such as encryption and access controls
- Regular Audits: Ongoing assessment of subprocessor compliance
Subprocessor Changes
We will notify customers at least 14 days in advance of any material changes to our subprocessors, including:
- Addition of new subprocessors
- Changes in data processing purposes
- Changes in data location or jurisdiction
- Removal of existing subprocessors
Enterprise customers may object to new subprocessors as outlined in their Data Processing Agreement. If you object to a subprocessor change, please contact us within 30 days to discuss alternative arrangements. If we cannot accommodate your objection, you may have the right to terminate the affected services in accordance with your Data Processing Agreement.
Questions About Subprocessors?
For questions about our subprocessors, to request additional due diligence information, or to discuss data processing arrangements, please contact our Data Protection team.
Email: hello@datastory.tech
Response time: Within 14 days