Subprocessors - Zernio

How this list works

We review every subprocessor before we use it and at least once a year after that, and we only share the personal data each one needs for the purpose listed below.

We post any new or replacement subprocessor here at least 14 days before it starts processing personal data. To get those notices by email, write to support@zernio.com with the subject "Subscribe to subprocessor updates". If you object to a change on reasonable data protection grounds, tell us within those 14 days and we will work with you to resolve it.

Where personal data leaves the EU or EEA, each entry below shows the safeguard: the EU-US Data Privacy Framework for certified providers, otherwise the EU Standard Contractual Clauses (Module 3). The social platforms you publish to, such as Instagram or LinkedIn, act as independent controllers and are not our subprocessors.

Infrastructure

Vercel Security and compliance
Purpose:
Application hosting and request processing
Data:
All service data in transit through the API and dashboard
Location:
London, UK (functions); global edge
Transfer safeguard:
EU-US Data Privacy Framework (Vercel Inc.)
PlanetScale Security and compliance
Purpose:
Primary database (Postgres)
Data:
Accounts, profiles, connected social accounts, posts, messages and service records
Location:
London, UK (AWS eu-west-2)
Transfer safeguard:
EU-US Data Privacy Framework (PlanetScale Inc.)
Cloudflare Security and compliance
Purpose:
CDN, network security, workers, queues and media storage
Data:
Media files and service data in transit
Location:
Media storage in Western Europe; global edge network
Transfer safeguard:
EU-US Data Privacy Framework (Cloudflare, Inc.)
Upstash Security and compliance
Purpose:
Redis for caching, coordination and locks
Data:
Short-lived cache and coordination entries
Location:
Provider-managed, not pinned to one region
Transfer safeguard:
EU-US Data Privacy Framework (Upstash, Inc.)
Railway Security and compliance
Purpose:
Hosting for the MCP server (mcp.zernio.com)
Data:
Requests from AI assistants connected to an account
Location:
Provider-managed, not pinned to one region
Transfer safeguard:
EU-US Data Privacy Framework (Railway Corporation)

Messaging and telephony

Telnyx Security and compliance
Purpose:
Phone numbers, SMS, RCS, calls and number registration (only when these features are used)
Data:
Messages, call records, phone numbers, and the identity and business documents submitted for regulated numbers
Location:
Depends on the service and the number's country
Transfer safeguard:
EU-US Data Privacy Framework (Telnyx LLC)
LoopMessage Security and compliance
Purpose:
iMessage sending and receiving (only when iMessage is used)
Data:
Messages, attachments and recipient phone numbers or email addresses
Location:
Provider-managed, not pinned to one region
Transfer safeguard:
Standard Contractual Clauses (Module 3)
Resend Security and compliance
Purpose:
Transactional email
Data:
Recipient email addresses and notification content
Location:
Provider-managed, not pinned to one region
Transfer safeguard:
EU-US Data Privacy Framework (Plus Five Five, Inc.)

Monitoring and analytics

Axiom Security and compliance
Purpose:
Operational logging and monitoring
Data:
Application logs and queue metrics
Location:
US East (N. Virginia), USA
Transfer safeguard:
Standard Contractual Clauses (Module 3)
Sentry Security and compliance
Purpose:
Error monitoring
Data:
Error reports, which can include account identifiers and request contents
Location:
Germany (EU region)
Transfer safeguard:
EU-US Data Privacy Framework (Functional Software, Inc.)
Tinybird Security and compliance
Purpose:
API analytics and application logs
Data:
Service events and post analytics
Location:
London, UK
Transfer safeguard:
Standard Contractual Clauses (Module 3)
PostHog Security and compliance
Purpose:
Product analytics
Data:
Dashboard and product interaction events
Location:
Provider-managed, not pinned to one region
Transfer safeguard:
EU-US Data Privacy Framework (PostHog Inc)

Support and AI

Crisp Security and compliance
Purpose:
Customer support chat and email
Data:
Support conversations, contact details and attachments
Location:
Provider-managed, not pinned to one region
Transfer safeguard:
No transfer (EU-based)
Anthropic Security and compliance
Purpose:
AI-assisted support and automated review of phone number registrations
Data:
Support conversations and diagnostic context; registration documents for regulated numbers
Location:
Provider-managed, not pinned to one region
Transfer safeguard:
Standard Contractual Clauses (Module 3)
Microsoft Azure Security and compliance
Purpose:
AI-assisted support (fallback model provider and support search)
Data:
Support conversations and diagnostic context, when used
Location:
Provider-managed, not pinned to one region
Transfer safeguard:
EU-US Data Privacy Framework (Microsoft Corporation)
Typesafe AI Security and compliance
Purpose:
AI checks inside the support assistant
Data:
Excerpts of support conversations
Location:
Provider-managed, not pinned to one region
Transfer safeguard:
Standard Contractual Clauses (Module 3)
Linear Security and compliance
Purpose:
Issue tracking for escalated support cases
Data:
Account context and diagnostics from escalated cases
Location:
Provider-managed, not pinned to one region
Transfer safeguard:
Standard Contractual Clauses (Module 3)
Slack Security and compliance
Purpose:
Internal team notifications for support and billing events
Data:
Account contact details and summaries of support or billing events
Location:
Provider-managed, not pinned to one region
Transfer safeguard:
EU-US Data Privacy Framework (Slack Technologies, LLC)
Featurebase Security and compliance
Purpose:
Feature requests board (requests.zernio.com)
Data:
Requests, comments and the submitter's name and email
Location:
Provider-managed, not pinned to one region
Transfer safeguard:
No transfer (EU-based)
Google Security and compliance
Purpose:
Business email, and address autocomplete in phone number registration forms
Data:
Email correspondence with customers; addresses typed into registration forms
Location:
Provider-managed, not pinned to one region
Transfer safeguard:
EU-US Data Privacy Framework (Google LLC)

Billing, attribution and compliance

Stripe Security and compliance
Purpose:
Payments
Data:
Billing identity, payment methods and invoices
Location:
Provider-managed, not pinned to one region
Transfer safeguard:
EU-US Data Privacy Framework (Stripe, LLC)
Metronome Security and compliance
Purpose:
Usage-based billing
Data:
Customer identifiers and usage metering
Location:
Provider-managed, not pinned to one region
Transfer safeguard:
Standard Contractual Clauses (Module 3)
Dub Security and compliance
Purpose:
Referral attribution (only for signups that arrive through a referral link)
Data:
Name, email and account identifier at signup
Location:
Provider-managed, not pinned to one region
Transfer safeguard:
Standard Contractual Clauses (Module 3)
Stape Security and compliance
Purpose:
Server-side tagging for signup conversion measurement
Data:
Signup email, name, country, IP address and browser details
Location:
Provider-managed, not pinned to one region
Transfer safeguard:
EU-US Data Privacy Framework (Stape Inc.)
Comp AI Security and compliance
Purpose:
Trust Center administration
Data:
Access requests, requester identity and NDA signatures
Location:
Provider-managed, not pinned to one region
Transfer safeguard:
EU-US Data Privacy Framework (Bubba AI, Inc. d/b/a Comp AI)