Companies that help us run Confinity.

• AWS

  Under re-verification
  Purpose: Under re-verification. This register names AWS for application compute, managed Postgres and object storage; the deployment configuration in cloudbuild.yaml provisions a different stack. Only a person with access to the running deployment can settle which is correct, so the field is held open rather than guessed at. The one AWS use this codebase does implement is inbound-email bounce and complaint handling over SES and SNS (src/app/api/ambient-capture/bounce/route.ts).Data types: Under re-verification, Email bounce and complaint notifications
  Legal entity: Amazon Web Services EMEA SARLSCC: Module 2 (controller → processor)Added: 2025-11-01
  Read their DPA ↗ (opens in a new tab)

• Cloudflare

  United States (global edge)
  Purpose: DNS, edge cache, WAF, image delivery, rate limitingData types: Request metadata, Cached public page content
  Legal entity: Cloudflare, Inc.SCC: Module 2Added: 2025-11-01
  Read their DPA ↗ (opens in a new tab)

• Stripe

  Ireland (EEA)
  Purpose: Subscription billing, payment method storageData types: Billing email, Last-four card digits, Country
  Legal entity: Stripe Technology Europe, LimitedSCC: Not applicable (EEA-hosted)Added: 2025-11-01
  Read their DPA ↗ (opens in a new tab)

• Resend

  United States (EU data residency)
  Purpose: Transactional email (magic-link, receipts, weekly digest)Data types: Email address, Subject line, First-line preview text
  Legal entity: Resend Inc.SCC: Module 2Added: 2025-11-01
  Read their DPA ↗ (opens in a new tab)

• Google Cloud (Vertex AI)

  Ireland (contracting) / European Union (processing, EU multi-region)
  Purpose: Composer assist on explicit request (Gemini via Vertex AI), in Confinity's own Google Cloud project; no training on inputsData types: Composer prompt text (ephemeral, in-project)
  Legal entity: Google Cloud EMEA LimitedSCC: Not applicable (EU-hosted, in-project)Added: 2026-07-11
  Read their DPA ↗ (opens in a new tab)

• Deepgram

  United States
  Purpose: Voice-to-text fallback when on-device Whisper unavailableData types: Audio sample (ephemeral)
  Legal entity: Deepgram, Inc.SCC: Module 2Added: 2025-11-01
  Read their DPA ↗ (opens in a new tab)

• Sentry

  Germany (EU data centre)
  Purpose: Error aggregation with server-side PII redactionData types: Stack trace, Redacted request metadata
  Legal entity: Functional Software, Inc. (Sentry)SCC: Not applicable (EU-hosted)Added: 2025-11-01
  Read their DPA ↗ (opens in a new tab)

• PostHog

  Germany (EU data centre)
  Purpose: Product analytics (event counts, no entry content)Data types: Page view, event name, user id
  Legal entity: PostHog EUSCC: Not applicable (EU-hosted)Added: 2025-11-01
  Read their DPA ↗ (opens in a new tab)

Rules we hold ourselves to

• We notify account holders by email at least 14 days before adding a new sub-processor that touches customer content.
• We review this list quarterly and re-confirm DPA links are current.
• Marketing sub-processors (e.g. analytics) never receive entry bodies or memorial content.