Sub-processors
Effective 14 September 2026
1. Providers that handle customer content
These see your uploaded media, reference audio, transcripts or generated audio.
| Provider | Role | Data | Location | Safeguard |
|---|---|---|---|---|
| Cloudflare, Inc. | Object storage for uploads, generated audio and voice clips | Media files and audio | European Union | Standard contractual clauses |
| Cerebrium | Audio processing, speech recognition and speech generation | Audio, derived transcripts, speaker embeddings | United States | Standard contractual clauses |
| Google Ireland Limited | Audio transcription, speaker identification and timestamps | Audio | United States and global | Standard contractual clauses |
| Anthropic PBC | Translation of transcript text. No audio or video is sent. | Transcript text only | United States | Standard contractual clauses |
2. Providers that run the platform
These see account and operational data, and may encounter content while it is in transit or at rest.
| Provider | Role | Data | Location | Safeguard |
|---|---|---|---|---|
| Supabase, Inc. | Authentication and the application database | Account identity, project metadata, transcripts, translations, usage and billing records | European Union (Stockholm) | Standard contractual clauses |
| Railway Corp. | Hosting for the application interface and background workers | All data in transit through the service | European Union | Standard contractual clauses |
| Vercel Inc. | Hosting and delivery of the web front end | Requests, session cookies, IP addresses | European Union (Stockholm) | Standard contractual clauses |
| Stripe Technology Europe Limited | Payment processing, subscription billing and tax calculation | Name, email, billing address, card data held by Stripe and never by us, payment history | Ireland, with group processing in the United States | Standard contractual clauses |
| Functional Software, Inc. (Sentry) | Error and uptime monitoring. Personal data collection is switched off. | Request identifiers, account identifiers, error traces | United States | Standard contractual clauses |
| GitHub, Inc. | Storage of encrypted database backups. GitHub cannot read them; the key is held separately. | Encrypted database dumps | United States | Standard contractual clauses |
3. Transfers outside the European Economic Area
Our web front end, our database and our object storage run inside the European Union. Speech separation, speech recognition, speech generation and translation run in the United States, as do error monitoring and encrypted backup storage. That means your uploaded media, your reference audio and your transcripts are transferred to the United States for processing.
Those transfers rely on the European Commission's standard contractual clauses, or on a provider's certification under the EU-US Data Privacy Framework where it holds one, together with encryption in transit and at rest and deletion of working copies once processing finishes. Write to privacy@dubedo.com for a copy of the safeguards for any specific provider.
4. Changes to this list
We give business customers at least 30 days' notice before adding or replacing a provider that handles customer content. If you object on reasonable data protection grounds within that period, we will work with you to find an alternative, and if we cannot, you may terminate the affected part of the service without penalty and receive a refund of any unused prepaid fees.
To be notified of changes, write to privacy@dubedo.com and ask to be added to the sub-processor notice list.