Current list, also published at detumble.ai/legal/subprocessors. Changes are notified under Section 6.2.
| Subprocessor | Entity and corporate location | Processing | Location of processing | Transfer mechanism |
|---|---|---|---|---|
| Amazon Web Services | Amazon Web Services EMEA SARL (Luxembourg) / Amazon Web Services, Inc. (USA) | hosting, compute, database, object storage, queues, secrets, e-mail delivery, logs, backups | EU, eu-north-1 (Stockholm) | data stays in the EU; AWS GDPR DPA with SCCs for any support access |
| Anthropic | Anthropic PBC (USA) | large language model inference on extracted drawing data and chat | United States | Anthropic DPA incorporating SCCs; contractual no-training; short retention |
| Polar | Polar Software, Inc. (USA) | merchant of record: checkout, subscriptions, invoices, tax, refunds (billing data only; no Customer Content) | United States, EU | Polar DPA and SCCs |
| Google LLC (USA) / Google Ireland Ltd | optional sign-in (account identifier, e-mail, profile) for Users; no Customer Content | worldwide | Google's terms and SCCs | |
| Plausible | Plausible Insights OÜ (Estonia) | cookieless aggregate analytics; no personal data retained; no Customer Content | EU | none required |
| Cloudflare | Cloudflare, Inc. (USA) | DNS; edge protection if enabled (request metadata only; no Customer Content) | worldwide edge | Cloudflare DPA and SCCs |