Trust
Sub-processors.
The complete list of organisations that process customer data on Driftstack's behalf, the region they operate in, what they do, and the contractual basis under which any non-EU transfer happens.
This page shows the same list in plain language; the authoritative list is Section 7 of the Privacy Policy. Section 3.4 of the Data Processing Agreement sets when a change to this list takes effect and the notice customers get. The same list appears in short as Annex 3 of the Data Processing Agreement.
| Sub-processor | Region | Purpose | Transfer mechanism (legal basis for any data leaving the EU) |
|---|---|---|---|
| Hetzner Cloud | Falkenstein, Germany (EU) | Compute infrastructure for the Driftstack service. | EU-resident — no transfer required. |
| Neon | Frankfurt (EU) | Managed Postgres: the whole Driftstack database. | Data stored in the EU (Frankfurt). US company (Databricks, Inc., parent of Neon, LLC): EU-US Data Privacy Framework; 2021 Standard Contractual Clauses where it does not apply. |
| Amazon Web Services | Frankfurt (EU) | Encrypted off-site backups of our database (S3 object storage). Each backup is encrypted before it is uploaded and is kept up to 40 days. | Data stored in the EU (Frankfurt). Contracting company in the EU (Amazon Web Services EMEA SARL, Luxembourg). Any transfer to a country outside the EEA without an EU adequacy decision is covered by the EU Standard Contractual Clauses in Amazon's data processing terms. |
| Cloudflare R2 | Default jurisdiction (data replicated EU + US); EU jurisdiction for the support-mail bucket | Object storage for customer-uploaded profile avatars, encrypted profile blobs, public status-page snapshots, and raw support email (messages and attachments) in a bucket with EU jurisdiction. | 2021 Standard Contractual Clauses + EU-US Data Privacy Framework. |
| Cloudflare Email Routing / Workers | Cloudflare edge (US corporate) | Receives every message sent to a @driftstack.dev or @driftstack.io address and passes it to the support inbox. | 2021 Standard Contractual Clauses + EU-US Data Privacy Framework. |
| Cloudflare Turnstile | Cloudflare edge (US corporate) | Turnstile (a bot check on our sign-up, sign-in and account-security pages and the visitor support chat). | 2021 Standard Contractual Clauses + EU-US Data Privacy Framework. |
| Postmark | United States | Transactional email (signup verification, password reset, billing notifications, support correspondence). | AC PM LLC (Postmark, an ActiveCampaign company), which states in its data processing agreement that it is certified under the EU-US Data Privacy Framework; 2021 Standard Contractual Clauses. |
| Sentry | EU region (ingest.de.sentry.io) | Error monitoring for the Driftstack service. | Data stored in the EU region. US company: 2021 Standard Contractual Clauses + EU-US Data Privacy Framework. |
| Stripe | Stripe Payments Europe, Limited (Ireland) for every customer; Stripe, LLC (United States) | Payment processing, subscription management, and VAT handling via Stripe Tax (Dutch BTW for customers in the Netherlands; the reverse charge only for business customers in other EU countries with a valid VAT number). | Contracting company in the EU (Stripe Payments Europe, Limited). US company (Stripe, LLC): EU-US Data Privacy Framework; where it does not apply, 2021 Standard Contractual Clauses in Stripe's Data Transfers Addendum. |
| Confirmo Limited | Ireland (EU) | Crypto payment processing: the hosted payment page, the payment address and the payment notices for crypto orders. Receives the order amount, the Plan, Driftstack's order reference and an Account reference. | Processes in the EU (Ireland); no transfer outside the EEA by Driftstack. |
| Anthropic | United States | Large language model (LLM) behind the optional AI agent feature. Engaged in two modes: (1) Bring your own key (BYOK) — the customer supplies their own Anthropic API key; the customer's contract is with Anthropic directly, and Driftstack only passes the request through without keeping it (a transient proxy). (2) Driftstack-provided access on AI Credits, included or bought (Terms §10.4) — no separate opt-in, and a customer's own key is used as the customer chooses in its settings (Terms §8.11); Driftstack uses its deployment-managed key, and that use is paid in AI Credits measured by the tokens the model uses (Terms §8.11). On the earlier API Builder and API Scale plans kept under Terms §8.13, and on an Enterprise account, where the account has opted in to Driftstack-billed AI use and has not been moved to AI Credits, each standard turn instead posts a $0.10 included-service accounting value against the account's enforced budget; that value is not separately itemized by Stripe, and Enterprise can use a contracted custom budget. Session data flows to Anthropic only when one of these two modes is actually used in a given AI step. Also used for sorting and reply drafting for support correspondence (email and in-app Help), with a person approving every written reply, and answering the in-product support assistant under human oversight (a person can be reached at any time); never for security@, legal@, abuse@ or privacy@. For support correspondence, Anthropic receives the subject and text of the conversation, with the credentials Driftstack recognises removed; the address written to, the channel, the topic and the sender-authentication result; the subjects of recent conversations a person re-sorted, as labelled examples; the sender's plan where the sender is a verified customer or a person linked the conversation to an account; for a verified customer, the account's status, customer-since date, whether its email address is verified or failing delivery, and its number of active API keys (never key values); and, only to draft a reply, a verified customer's billing basics (the subscription's status and current period end, the dates and amounts of recent invoices including any amount refunded or disputed, the trial end date and the date of the first session) and, for a message sent from the desktop app, the app details the customer included with it (the app version, platform, deployment, session and profile identifiers, and the last error lines the app displayed). None of it is used to train any model. | 2021 Standard Contractual Clauses. |
| Moneybird | Netherlands (EU) | Accounting and invoicing operations for Driftstack. | EU-resident — no transfer required. |
| MacStadium | United States | Mac hardware hosting for iPhone Safari sessions. | 2021 Standard Contractual Clauses + EU-US Data Privacy Framework. |
| Green Mini host B.V. | Netherlands (EU) | Mac hosting for a serving machine that can run Sessions: when a Session runs on it, it holds the Session's browser profile (cookies and site storage) while the Session runs and deletes it from the machine when the Session ends, carries the Session's page traffic to the egress proxy, sends the live view, runs the task or steps the Session is given, keeps input-timing data without the keys typed (up to 7 days), and keeps a technical log of Session events (Session ids, addresses visited, timings). | EU-resident — no transfer required. |
Region preference vs. where your data lives.
The "region" you can pick from /settings → Region (us / eu / apac) is a stated preference. It does not move your data. Today, every customer's database records — account, profiles, sessions, audit logs — are stored in the EU (Frankfurt) with the providers listed in the table above, regardless of region preference. Files on Cloudflare R2 (avatars, encrypted profile data, public status snapshots) use R2's default jurisdiction, which keeps copies in both the EU and the US under the transfer mechanism listed in the table.
Today this setting is a recorded preference only. It does not change where your sessions run or where your data is stored: whichever option you pick, or none, your data is placed as described above.
Change notices.
When we give notice of a change to this list under Section 3.4 of the Data Processing Agreement, it is listed here. A correction of how an entry is described, without changing the Processing, is published on the Sub-processors page and needs no notice period.
No change notice is open.
How sub-processor changes work.
When Driftstack adds or replaces a sub-processor, or materially changes what an existing one does, Section 3.4 of the Data Processing Agreement sets when the change takes effect and, after Launch, how we give notice of it: a dated notice on the Sub-processors page, and by email as well if you ask at [email protected]. The notice states what is changing, the basis for any new transfer, and the last day to object.
You may object on reasonable data-protection grounds by writing to [email protected]. We discuss it and offer an alternative where we reasonably can; otherwise you may end the affected service without penalty, with a pro-rata refund of prepaid fees. The full rule is section 3.4 of the DPA.
For questions about the list, email [email protected].