This page identifies third-party providers that Streamforge may use to Process Customer Personal Data under the Data Processing Agreement. A provider receives data only when its service is configured and relevant to the Customer’s use of Streamforge.

General authorization and changes. Customer authorizes the providers below under Section 6 of the DPA. Streamforge will post material changes here and, where practicable, provide email or in-product notice. To request change notices or object on documented data-protection grounds, email privacy@streamforge.com.

Location note. The locations below describe primary or provider-supported regions and may include remote support or other locations permitted by the provider’s terms. Applicable transfer safeguards are addressed in the DPA.

Core infrastructure and delivery

DigitalOcean. Cloud hosting, managed data services, and object storage. Data: Customer Content, account and application records, files, logs, and backups. Location: United States, including New York, and other configured regions.

Hetzner. Cloud and data-center infrastructure, databases, and backup storage. Data: Application and database records, service data, and protected backups where the relevant environment is hosted. Location: European Union and other configured regions.

MongoDB Atlas. Managed database infrastructure. Data: Customer workspace records, messages, analysis records, and associated metadata where stored in Atlas. Location: Provider-selected or configured region.

Backblaze. Object storage and media or document delivery. Data: Uploaded files, documents, cached media, and object metadata. Location: United States.

Cloudflare. Network delivery, DNS, content delivery, and security services. Data: IP addresses, request metadata, and content transmitted through protected endpoints. Location: Global network.

Connected accounts and communications

Nylas. Connected-email authentication, synchronization, sending, and webhooks. Data: OAuth tokens, mailbox identifiers, email content, headers, recipients, attachments, and event metadata. Location: United States or another customer-selected Nylas region.

Google. Google OAuth, Gmail and YouTube APIs, Workspace services, and related account integrations. Data: Connected-account identifiers, authorization data, messages or API content selected by Customer, and usage metadata. Location: United States and global infrastructure.

Twilio SendGrid. Transactional and customer-directed email delivery. Data: Recipient and sender details, message content, delivery events, and related metadata. Location: United States and global infrastructure.

Resend. Transactional email delivery. Data: Recipient and sender details, message content, and delivery metadata. Location: United States.

Twilio. SMS and communications services where enabled. Data: Phone numbers, message content, and delivery metadata. Location: United States and global infrastructure.

Kickbox. Email-address verification. Data: Email addresses and verification results. Location: United States.

Security, analytics, support, and business operations

Sentry. Application error monitoring and diagnostics. Data: User or account identifiers, device and request context, errors, traces, and diagnostic metadata. Location: United States.

LogRocket. Session replay and product diagnostics for eligible production accounts. Data: User and organization identifiers, browser and interaction data, and network metadata; designated authentication payloads and authorization headers are excluded from recording. Location: United States.

PostHog. Product analytics and feature measurement where enabled. Data: User or account identifiers, device data, events, and usage metadata. Location: United States.

Google Analytics and Google Tag Manager. Website and product analytics and tag management where enabled. Data: Device, cookie, network, and usage-event data. Location: United States and global infrastructure.

Intercom. Customer support and in-product communications. Data: Business contact details, account context, support conversations, and attachments. Location: United States.

SigNoz. Application telemetry and observability. Data: Logs, traces, metrics, request context, and diagnostic metadata. Location: United States.

New Relic. Service monitoring and operational diagnostics where enabled. Data: Logs, metrics, traces, and diagnostic metadata. Location: United States.

Slack. Support, security, and incident collaboration. Data: Support or bug-report content, business contact data, screenshots, and incident metadata shared for resolution. Location: United States and global infrastructure.

Linear. Issue, feature-request, and bug tracking. Data: Support or bug-report content, business contact data, screenshots, and diagnostic metadata shared for resolution. Location: United States.

PandaDoc. Order forms, contracting, and electronic-signature workflows. Data: Business contact details, contract content, signatures, and transaction metadata. Location: United States and global infrastructure.

Stripe. Subscription billing and payment processing. Data: Payer and business contact details, billing identifiers, and transaction metadata. Streamforge does not receive full card numbers from Stripe. Location: United States, Canada, and global infrastructure.

AI and research features

The providers in this section receive Customer Personal Data only when the corresponding AI, analysis, search, enrichment, or research feature is used. Inputs are limited to the prompts, selected records, documents, or context required for that feature.

OpenRouter. Routing requests to selected AI model providers. Data: Prompts, selected Customer Content, analysis context, outputs, and request metadata. Location: United States; downstream model-provider locations vary.

OpenAI. AI generation, extraction, classification, and analysis where selected. Data: Prompts, selected Customer Content, outputs, and request metadata. Location: United States and provider-supported regions.

Anthropic. AI generation and analysis where selected. Data: Prompts, selected Customer Content, outputs, and request metadata. Location: United States.

Google Cloud Vertex AI and Gemini. AI generation, classification, and analysis where selected. Data: Prompts, selected Customer Content, outputs, and request metadata. Location: United States and configured Google Cloud regions.

Portkey. AI gateway, request routing, and model observability where enabled. Data: Prompts, selected Customer Content, outputs, and model-request metadata. Location: Provider-supported regions.

Exa. Web search and research. Data: Search queries, selected research context, target identifiers, and returned results. Location: United States.

SerpApi. Search-engine results retrieval where enabled. Data: Search queries, target identifiers, and request metadata. Location: United States.

Bright Data. Web data retrieval and search infrastructure where enabled. Data: Search queries, target identifiers, and network-request metadata. Location: Global infrastructure.

xAI. Downstream AI model processing through OpenRouter where selected. Data: Prompts, selected Customer Content, outputs, and request metadata. Location: United States.

Perplexity. Downstream AI search and model processing through OpenRouter where selected. Data: Prompts, selected Customer Content, outputs, search context, and request metadata. Location: United States.

DeepSeek. Downstream AI model processing through OpenRouter where selected. Data: Prompts, selected Customer Content, outputs, and request metadata. Location: Provider-supported locations.

Scope note for public creator data

Streamforge also uses data suppliers and platform APIs to obtain or enrich publicly available creator and audience information. When Streamforge determines the purposes and means of that processing independently, it acts as a Controller rather than Customer’s Processor, so those providers are outside this DPA list. Examples include MediaCrawlers, RocketAPI, TokAPI, RapidAPI data suppliers, YouTube, Twitch, and SullyGnome. Streamforge’s Privacy Policy governs that separate activity.

Last updated: September 2, 2026.