Legal
Annex III: Subprocessors
The vendors that help us run Storm OS and what each one receives. Workspace admins are told by email when we add one, and can object.
This list is Annex III of the Data Processing Addendum, version 1.4, effective October 20, 2026.
Used for every Workspace
| Subprocessor | Legal entity and location | Processing activity | Personal Data processed | Location of processing |
|---|---|---|---|---|
| Netlify | Netlify, Inc., USA | Application hosting, serverless functions, CDN, blob storage for attachments and export bundles, the link and open tracking service, published landing pages, and error and performance monitoring | All data in transit to and from the Service; attachments and files at rest; diagnostic data | USA |
| Neon | Neon, Inc., USA | Managed serverless Postgres database | All Workspace data and account data at rest | United States and Germany |
| Resend | Resend, Inc., USA | Transactional email (verification, invitations, notifications) and marketing email sent on a Workspace's behalf | Recipient email address, message content, and engagement events | USA |
| Google LLC | Google LLC, USA | Identity provider, for anyone who signs in with Google | Sign-in identity only | USA |
| Stripe | Stripe, Inc., USA | Subscription billing and payment processing for Storm OS plans | Billing contact name, email, address, tax ID, payment status | USA |
Used only while a Workspace has a feature on
The assistant and web research are on unless a Workspace Admin turns them off. Nothing is sent to these Subprocessors while the assistant is off, and the three data providers are used only while web research is also on and an Authorized User runs research on a record or a saved list.
| Subprocessor | Legal entity and location | Processing activity | Personal Data processed | Location of processing |
|---|---|---|---|---|
| Anthropic | Anthropic, PBC, USA | The assistant's features: record summaries and overviews, description drafts, the daily assistant and its morning email, reading documents added as project, campaign or record context, contract imports, Quick Paste and photo capture, and, in a research run, the web search and page reading Anthropic performs and the comparison of what the data providers returned | Record content sent with each request, which may include names, job titles, contact details, notes, activity, and deal and project details; the text of documents uploaded as context or imported; images taken with photo capture; for research, the person or company being researched and what is already on file about them | USA for data Anthropic stores; Anthropic may run the model in other countries it uses |
| CompanyEnrich | STDİO BİLİŞİM SANAYİ VE TİCARET LİMİTED ŞİRKETİ, Ankara, Türkiye | Company and employer details for research | For a company: its website domain, or its name and LinkedIn address. For a person: their employer's website domain or, where none is known, the first email address on the record | Finland |
| Data Legion | Data Legion Inc., Austin, Texas, USA | Identity matching, and person and company details, for research, under its published terms (DPA §7.3) | For a person: the first email address on the record, which may be a personal one, or their LinkedIn address, or their last name (and first name where known) with their employer's website domain or company name. For a company: its website domain, LinkedIn address or name | Not published by Data Legion; every subprocessor it lists, including AWS, is in the USA |
| NinjaPear | NinjaPear Pte Ltd, Singapore | Person and company details for research, under its published terms (DPA §7.3). NinjaPear may answer from data it already holds, and may keep what a lookup finds | For a person: their first and last name with their employer's website, and a work email address where one is on file (never an address at a common personal email provider such as Gmail, Outlook or Yahoo). For a company: its website | NinjaPear's operating offices, and wherever others involved in the processing are located, per its privacy policy |
Anthropic publishes its own subprocessors, including any provider behind its web search, at https://www.anthropic.com/subprocessors.
Integrations a Workspace connects itself. MailChimp, a Workspace's own Stripe account for invoice payments, and a Workspace's own Anthropic key are Integrations under §9 of the Terms. Each runs on the Workspace's own account with that provider, under the Workspace's own agreement with it and on the Workspace's instruction, and none of them is a Storm OS Subprocessor. With a Workspace's own Anthropic key, two things still run on Storm OS's accounts: the background reading of documents already filed on people, companies and deals, which uses Storm OS's Anthropic account, and a research run's calls to the data providers above.
The current list is maintained at https://storm-os.app/subprocessors.
Questions about any of this go to legal@storm-os.com. Privacy requests go to privacy@storm-os.com, and anything security related to security@storm-os.com. Earlier versions of these documents are kept at storm-os.app/privacy/archive.