Subprocessors
The third parties below process Personal Data on behalf of VUMY Technologies in the operation of vumyo. Adding or removing a subprocessor bumps this list and surfaces in the RSS feed auditors and enterprise customers can subscribe to. Machine-readable JSON is available at /subprocessors.json.
Current subprocessors
| Name | Purpose | Region | Category | Effective date |
|---|---|---|---|---|
| Cloudflare, Inc. | Edge gateway, container compute, R2 object storage, Durable Objects (real-time), AI Gateway, CDN. | Global edge with US data plane | Hosting / Infrastructure | 2026-02-01 |
| Neon (Databricks) | Managed Postgres for vumyo workspace data. Row-Level Security tenant isolation enforced at the application layer. | AWS us-east-1 | Database | 2026-02-01 |
| Anthropic PBC | AI inference for the Sutra workspace assistant. Workspace data is not used for model training. | United States | AI | 2026-02-15 |
| Didit | Document OCR and identity verification within Secure module. Optional integration; only invoked on workspaces that opt in. | United States | Identity verification | 2026-03-01 |
| BioID | Liveness detection within Secure module. Only invoked on verifications that require liveness. | European Union | Identity verification | 2026-03-01 |
| Resend | Transactional email delivery (verification, important application events, system notifications). | United States | 2026-02-01 | |
| Stripe | Subscription billing for vumyo paid tiers. Card data is processed by Stripe; vumyo never receives full PAN. | Global | Payments | 2026-02-01 |
| OAuth-scoped calendar synchronization for the Slot module. Only invoked when a user connects their Google calendar. | Global | Calendar (optional integration) | 2026-02-01 | |
| Microsoft | OAuth-scoped Outlook calendar synchronization for the Slot module. Only invoked when a user connects their Outlook calendar. | Global | Calendar (optional integration) | 2026-02-01 |
Notice and objection
Material additions are announced via the RSS feed at least 30 days before they take effect, where practical. Customers may object via /contact within 30 days of notice; if the objection cannot be resolved, the customer may terminate the affected services.
Optional integrations
Subprocessors marked "optional integration" (Google Calendar, Outlook Calendar, Didit, BioID) are only invoked when a workspace explicitly opts in. Workspaces that do not enable these integrations never transmit data to them.