Trust center

Subprocessors

These are all the third parties that process personal data or Client Data for Instama: what for, which data, where, and under which safeguard.

Our automated tests fail when the platform starts using a provider that is not on this list, so it cannot fall behind the code. We tell you at least 30 days before a new subprocessor starts processing Client Data, and you may object in that period.

SubprocessorPurposeDataLocationTransfer safeguard
SupabaseDatabase, file storage and authenticationAll Client Data, accounts, sessions and audit recordsEuropean UnionEU-US Data Privacy Framework or Standard Contractual Clauses
VercelHosting of the platform and website, image and PDF rendering sandboxes, AI GatewayRequests and responses in transit; files being rendered; prompts and outputs of AI requestsEuropean UnionEU-US Data Privacy Framework or Standard Contractual Clauses
Amazon Web ServicesVideo renderingThe content and media of the video being renderedEuropean UnionEU-US Data Privacy Framework or Standard Contractual Clauses
fal.aiImage and video modelsPrompts, input images and generated media of a requested taskUnited States and provider regionsStandard Contractual Clauses
Anthropicthrough Vercel AI GatewayLanguage models: assistant, writing, planning, reviewPrompts and Client Data a requested task needsUnited States and provider regionsEU-US Data Privacy Framework or Standard Contractual Clauses
OpenAILanguage models, image editing and speech-to-textPrompts, Client Data and audio a requested task needsUnited StatesEU-US Data Privacy Framework or Standard Contractual Clauses
Googlethrough Vercel AI Gateway and fal.aiVision, captions, translation, image and video modelsPrompts and Client Data a requested task needsUnited States and provider regionsEU-US Data Privacy Framework or Standard Contractual Clauses
TypeSafethrough Vercel AI GatewayAutomated decisions inside the platform, with zero data retentionThe brief, message or draft a decision is aboutProvider regionsStandard Contractual Clauses
Coherethrough Vercel AI GatewaySearch: embeddings and rankingThe text of content being indexed or searchedUnited StatesStandard Contractual Clauses
Perplexitythrough Vercel AI GatewayWeb search and reading web pages on requestSearch queries and page addressesUnited StatesStandard Contractual Clauses
FirecrawlReading a brand's public website during onboardingAddresses of public web pagesUnited StatesStandard Contractual Clauses
ResendTransactional e-mailE-mail address, name and the content of sign-in codes, invitations and notificationsSent from the European Union (Ireland); stored in the United StatesEU-US Data Privacy Framework or Standard Contractual Clauses
MolliePaymentsBilling details; card and bank details are entered on Mollie’s own pageEuropean UnionStays in the EEA
CalendlyScheduling demos booked on the websiteName, e-mail address and booking answersUnited StatesEU-US Data Privacy Framework or Standard Contractual Clauses
Google AnalyticsWebsite and platform analytics, only after consentCookie identifiers, pages visited, browser and approximate locationUnited States and Google regionsEU-US Data Privacy Framework or Standard Contractual Clauses

How we choose and oversee them

  • Each subprocessor is bound by a data processing agreement with confidentiality and security obligations.
  • Infrastructure that stores Client Data (database, file storage, hosting, rendering) runs in EU regions on providers independently certified to SOC 2 Type II and ISO/IEC 27001.
  • A provider receives only what a request needs. AI model providers, for example, see the content of the task they perform, not your workspace.
  • Transfers outside the European Economic Area rely on the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses. You can ask us for the safeguards that apply to a transfer.

Questions about a subprocessor: security@instama.co.