Companies that help us run Confinity.

• AWS

  Luxembourg (primary) / United Kingdom (region: eu-west-2)
  Purpose: Application compute, managed Postgres, object storageData types: All customer content, Operational telemetry
  Legal entity: Amazon Web Services EMEA SARLSCC: Module 2 (controller → processor)Added: 2025-11-01
  Read their DPA ↗ (opens in a new tab)

• Cloudflare

  United States (global edge)
  Purpose: DNS, edge cache, WAF, image delivery, rate limitingData types: Request metadata, Cached public page content
  Legal entity: Cloudflare, Inc.SCC: Module 2Added: 2025-11-01
  Read their DPA ↗ (opens in a new tab)

• Stripe

  Ireland (EEA)
  Purpose: Subscription billing, payment method storageData types: Billing email, Last-four card digits, Country
  Legal entity: Stripe Technology Europe, LimitedSCC: Not applicable (EEA-hosted)Added: 2025-11-01
  Read their DPA ↗ (opens in a new tab)

• Resend

  United States (EU data residency)
  Purpose: Transactional email (magic-link, receipts, weekly digest)Data types: Email address, Subject line, First-line preview text
  Legal entity: Resend Inc.SCC: Module 2Added: 2025-11-01
  Read their DPA ↗ (opens in a new tab)

• OpenAI

  Ireland (contracting) / United States (processing — SCC-covered)
  Purpose: Composer assist on explicit request, Zero-Data-Retention tierData types: Composer prompt text (ephemeral)
  Legal entity: OpenAI Ireland Ltd (EEA entity)SCC: Module 2 + Zero-Retention AddendumAdded: 2025-11-01
  Read their DPA ↗ (opens in a new tab)

• Deepgram

  United States
  Purpose: Voice-to-text fallback when on-device Whisper unavailableData types: Audio sample (ephemeral)
  Legal entity: Deepgram, Inc.SCC: Module 2Added: 2025-11-01
  Read their DPA ↗ (opens in a new tab)

• Sentry

  Germany (EU data centre)
  Purpose: Error aggregation with server-side PII redactionData types: Stack trace, Redacted request metadata
  Legal entity: Functional Software, Inc. (Sentry)SCC: Not applicable (EU-hosted)Added: 2025-11-01
  Read their DPA ↗ (opens in a new tab)

• PostHog

  Germany (EU data centre)
  Purpose: Product analytics (event counts, no entry content)Data types: Page view, event name, user id
  Legal entity: PostHog EUSCC: Not applicable (EU-hosted)Added: 2025-11-01
  Read their DPA ↗ (opens in a new tab)

Rules we hold ourselves to

• We notify account holders by email at least 14 days before adding a new sub-processor that touches customer content.
• We review this list quarterly and re-confirm DPA links are current.
• Marketing sub-processors (e.g. analytics) never receive entry bodies or memorial content.