Subprocessors
Last updated: September 4, 2026
Recordable uses the third-party subprocessors listed below to deliver the Service. Each subprocessor is bound by a written data processing agreement with terms no less protective than our Data Processing Addendum, and access to Customer Personal Data is limited to what each subprocessor needs to perform its function.
This page is the authoritative list referenced by our Data Processing Addendum. It is updated whenever a subprocessor is added, removed, or replaced.
Change notifications
We notify customers at least 30 days before adding or replacing a subprocessor that handles Customer Personal Data. Enterprise customers can subscribe to subprocessor change notifications by emailing privacy@recordable.ai with the subject Sub-processor notifications. Objections raised within the 30-day window are addressed under §8 of the DPA.
| Subprocessor | Purpose | Region(s) | Transfer mechanism |
|---|---|---|---|
| Clerk | User authentication, session management, and account directory. | United States | EU SCCs (2021/914) + EU-US Data Privacy Framework |
| WorkOS | SAML / OIDC single sign-on and SCIM directory sync for Enterprise customers. | United States | EU SCCs + EU-US Data Privacy Framework |
| Stripe | Subscription billing, payment processing, and tax invoice generation. | United States and EU (Ireland) | EU SCCs + EU-US Data Privacy Framework |
| Neon | Managed PostgreSQL hosting for workspace, workflow, and account metadata. | EU (Frankfurt) | Processed within the EEA, no transfer mechanism required |
| Cloudflare R2 | Object storage for redacted screenshots, recordings, and generated PDF/PPT exports. | EU (default region selected for the bucket) | Processed within the EEA, no transfer mechanism required |
| Cloudflare (CDN, Turnstile) | Edge CDN, DDoS protection, and Turnstile CAPTCHA on the public viewer email gate. | Global edge (request served from the closest PoP) | EU SCCs + EU-US Data Privacy Framework |
| Modal Labs | Serverless GPU compute that runs the workflow analysis pipeline. Transient. Assets are not retained after the run. | United States | EU SCCs |
| Google Cloud (Gemini / Vertex AI) | Default AI provider for workflow analysis and translation (Google Cloud Gemini, optionally via Vertex AI). | EU (configurable via Vertex AI) and United States | EU SCCs + EU-US Data Privacy Framework |
| Anthropic | Optional AI provider for agent runs and (at our discretion) workflow analysis. | United States | EU SCCs (used only when this provider is selected) |
| OpenAI | Optional AI provider for agent runs and (at our discretion) workflow analysis. | United States | EU SCCs (used only when this provider is selected) |
| Resend | Transactional email delivery (account verification, shared-workflow notifications, billing receipts). | United States | EU SCCs |
| PostHog | Product analytics and session replay for app.recordable.ai. Loaded only after the visitor consents to analytics. | EU (Frankfurt) | Processed within the EEA, no transfer mechanism required |
| Google Analytics | Marketing-site visit analytics for recordable.ai. Loaded only after the visitor consents to analytics. | United States | EU SCCs + EU-US Data Privacy Framework + IP anonymization |
| LinkedIn Ireland Unlimited Company | Advertising measurement for recordable.ai: conversion events from LinkedIn ad campaigns, including a hashed email address when an account is created. Only when the visitor consents to advertising. | Ireland / United States | EU SCCs + EU-US Data Privacy Framework |
Auxiliary service providers (no Customer Personal Data)
The following providers support our operations but do not process Customer Personal Data, so they are not subprocessors under Art. 28 GDPR. Listed here for transparency: GitHub (source control), Linear (issue tracking), Sentry (error monitoring, PII scrubbed before upload), Slack (internal communications), Notion (internal documentation).
Questions
For questions about this list, to request the latest signed DPA, or to subscribe to change notifications, email privacy@recordable.ai.