Current sub-processors
These providers process personal data on our behalf to run the service, each under a data processing agreement consistent with our DPA. Transfer mechanisms are noted per provider; where a provider is US-based we rely on the EU-US Data Privacy Framework (where certified) with Standard Contractual Clauses as fallback.
| Provider | Purpose | Personal data | Location / transfer mechanism |
|---|---|---|---|
| Neon (Postgres) | Primary database | All service data, incl. respondent profiles, transcripts, reports | EU region (Frankfurt); SCCs as fallback |
| Vercel | Application hosting, cookieless web analytics, audio file storage (Blob) | Request data; voice recordings (private store) | EU function region; US entity — DPF-certified + SCCs |
| OpenAI | AI interviewer and report generation (API) | Study brief, respondent profile, interview Q/A | EU data-residency project where available; SCCs; API data not used for training |
| Anthropic | AI insights assistant for org admins (API) | Interview answers and reports (respondent emails redacted) | US/EU; SCCs/DPF; API data not used for training |
| ElevenLabs | Speech-to-text transcription of voice answers | Raw voice recordings of consenting respondents | US entity — DPF-certified; zero-retention mode |
| PostHog (EU Cloud) | Product analytics and consent-gated session replay (admins only) | Admin usage events; respondent flows are anonymous and masked | EU (Frankfurt) |
| Resend | Transactional email (sign-in links, invites) | Recipient email addresses and names | US — DPF-certified + SCCs |
| Stripe | Payment processing (customer billing only) | Billing contact and payment data of customers | US/global — DPF-certified + SCCs |
| Braintrust | AI observability and evaluation | AI traces with respondent identity hashed | US — SCCs |
| E2B | Sandboxed execution environment for the insights assistant | Interview data the admin asks the assistant about (emails redacted) | US/EU — SCCs |
Change notifications
We update this page at least 30 days before adding or replacing a sub-processor that handles respondent data, and notify organization owners by email. Objections on reasonable data-protection grounds: contact@zoneoftruth.com (see DPA §5).
Change log
17 July 2026— initial published list; added ElevenLabs (transcription), previously missing from the Privacy Policy’s sub-processor summary.