Sub-processors

The list

Each of these processes personal data only on our instructions and under a contract. The same list appears in our privacy policy, generated from the same source, so the two can never disagree.

Cloudflare, Inc., United States, global edge network. Hosting, content delivery, object storage, bot protection and staff access control. Processes every request to the site.

Supabase, Inc., United States. The managed PostgreSQL database that stores the records described in this policy: enquiries, accounts, orders, support tickets, and client files.

Stripe, Inc., United States and Ireland. Payment processing. Card details are entered directly with Stripe and never reach our servers; we store only Stripe's customer and payment identifiers.

Resend, Inc., United States. Delivery of transactional email: sign-in links, order confirmations, download links, invoices and support replies.

PostHog, Inc., United States. Product analytics, loaded only after you accept analytics cookies. Some server-side events are recorded on a legitimate-interest basis and are described in the analytics section below.

Google LLC and Google Ireland Ltd, United States and Ireland. Analytics and advertising measurement, subject to your cookie choice. Separately, Google Workspace holds our mailbox, calendar and the document drive where client files are mirrored.

Meta Platforms, Inc. and Meta Platforms Ireland Ltd, United States and Ireland. Advertising measurement and lead forms, and WhatsApp Business messaging where you contact us that way. Where we send conversion data, contact details are hashed before transmission.

Sentry (Functional Software, Inc.), United States. Error monitoring, configured not to attach personal data to reports.

Discord, Inc., United States. Internal notifications to our team when an enquiry, order or support ticket arrives, and client discussion threads where a client has one.

Fathom Video, Inc., United States. Recording, transcription and summarising of scheduled calls, where the meeting is recorded. Participants are told at the start of the call.

Cal.com, Inc., United States. Meeting scheduling when you book a call with us.

Backblaze, Inc., United States. Encrypted off-site backup copies of the database and stored documents.

GitHub, Inc., United States. Source control, and the repositories we provision for client engagements.

AI providers

Requests to our AI features are routed to whichever provider is configured for that task, so any of the following may receive the content described in the privacy policy. We do not currently mask personal data before sending it, and we do not currently hold a zero-retention agreement with every provider on this list.

Anthropic PBC (United States)

OpenAI, L.L.C. (United States)

Google LLC, Gemini models (United States)

Mistral AI SAS (France)

Groq, Inc. (United States)

OpenRouter, Inc. (United States)

Cloudflare, Inc., Workers AI (United States)

Run on our own servers

Some services run on SDEN's own server rather than at a vendor: newsletter delivery, workflow automation, and AI observability. They are not third parties, but they hold personal data and are covered by the same security measures.

Changes

This list is kept current. If you are a client, we notify you of a change under your data processing agreement. If you want to be told about changes and you are not a client, write to info@sden.ai and we will add you.

Contact

SDEN AI LLC, 254 Chapman Rd, Ste 208 #28196, Newark, DE 19702, United States. Questions: info@sden.ai.