A subprocessor handles personal data on a customer's behalf as part of the service we deliver. A business supplier is not automatically a subprocessor for every workspace. Which providers receive data depends on the features, support interactions and integrations used.
The DPA governs authorization, written protections, transfers and our responsibility for subprocessors. The Trust Center also publishes vendor information and security material.
1. Infrastructure and service delivery
| Provider | Function and data involved | Location information |
|---|---|---|
| Amazon Web Services (AWS) | Object storage, media processing and delivery; recordings, images and associated metadata. | Application configuration includes US East and Paris media-storage options. Confirm the selected workspace region and any ancillary processing. |
| Render | Application hosting, databases and background processing; workspace data and operational logs. | Deployment region and support-access locations must be confirmed for the contracted service. |
| Cloudflare | Network protection and content delivery; requests, IP addresses and media where delivery is enabled. | Distributed network; an edge location is not a data-residency commitment. |
| Whereby | Embedded live calls and enabled call recording; media streams, participant and session information. | Media routing, recording and support locations depend on the contracted configuration. |
| Google AI / Gemini | Configured transcription, media analysis, summaries, answers and embeddings; selected media, text and context. | Confirm the API product, billing arrangement, processing locations and provider retention. Customer-supplied credentials use the customer's provider arrangement. |
The region descriptions above identify what the reviewed sources establish; they do not certify EU-only processing. Specific residency promises must be documented in your signed agreement and matched to the deployed configuration.
2. Operational and customer-support providers
| Provider | Purpose and potential data |
|---|---|
| Sentry | Error monitoring; application diagnostics, identifiers and relevant error context. |
| Better Stack | Operational monitoring and logging; service events and diagnostic data where configured. |
| PostHog | Product usage analysis; user or workspace identifiers and usage events where enabled. |
| Intercom | Customer support; contact details, conversation content and information you send to support. |
| Brevo | Customer communications; contact details and message or delivery information. |
| Google Workspace, Slack, Linear and GitHub | Internal communications and issue investigation; limited customer information where necessary for support or engineering. |
Only disclose content needed for a support request. Detailed contracting entities, processing locations and transfer safeguards for this draft inventory must be verified before it is adopted as the authorization schedule.
3. Website, billing and compliance services
Vercel hosts the marketing site and provides optional website measurement. Google Analytics supplies optional website analytics. Stripe handles billing and payments. HubSpot supports business relationship management. Comp AI supports compliance evidence, policies and the Trust Center. These services may process business-contact or operational information for which Screendesk acts as controller, and are not all recipients of customer recordings.
The Trust Center's broader vendor register also includes tools for identity, development, finance and internal operations. A listing there does not establish that a vendor receives every customer's content. The Privacy Policy applies to our controller activities; the DPA applies when a provider actually processes customer-controlled personal data on our behalf.
4. Customer-selected integrations
When you connect Zendesk, Intercom, a CRM, a calendar, an issue tracker or another destination under your own account, you instruct the relevant exchange. Your direct agreement with that provider governs its independent processing. This is separate from a provider Screendesk appoints to deliver its own service. We remain responsible for our own integration code and processing.
5. Changes and objections
We give at least 30 days' advance notice of additions or replacements to the workspace's designated administrative or privacy contact, with limited urgent exceptions and preserved rights as described in the DPA. Keep that contact current, or email support@screendesk.io to designate a privacy contact.
You may object on reasonable data-protection grounds during the notice period. We will discuss alternatives or mitigation; if no reasonable resolution is available, the DPA provides a right to end the affected service and recover unused prepaid fees. Updating this page alone does not substitute for the contractual notice.