Trust
Sub-processors
Serge relies on a small set of vetted third parties to deliver the product. This page lists every sub-processor that touches customer data, where it sits, the legal mechanism for any cross-border transfer, and a link to that provider's Data Processing Agreement. Customers under our DPA receive 30 days' notice before any sub-processor is added or replaced.
Last updated
| Provider | Purpose | Region | Transfer mechanism | Certifications | DPA |
|---|---|---|---|---|---|
| Vercel | Application hosting, edge runtime, CDN, and Blob storage for replay screenshots. | EU (Frankfurt) + US control plane | EU residency | SOC 2 Type II · ISO 27001 | View DPA → |
| Neon | Primary Postgres database — workspace data, scans, snippet events, replay metadata. | EU-Central (Frankfurt) | EU residency | SOC 2 Type II | View DPA → |
| Clerk | Authentification, gestion des sessions et provisionnement des identités. | United States | DPF | SOC 2 Type II | View DPA → |
| Anthropic | API Claude pour les recommandations de campagne — reçoit les faits confirmés sur l’entreprise (marque, catégorie, offre, preuves), la note d’audience que vous saisissez, ainsi que votre ton et vos contraintes pour proposer une première annonce ; lit également les pages publiques du site d’un client pour rédiger ces faits avant leur confirmation ; exécute aussi le replay actif (Investigate Mode) contre le site du client lorsque cette fonction est activée. Aucune adresse e-mail ni donnée de compte ou de facturation n’est transmise. | US (EU residency requires Enterprise / Bedrock) | SCCs | SOC 2 Type II | View DPA → |
| Browserbase | Managed headless Chrome instance for replay sessions. | EU (eu-central-1 Frankfurt) | EU residency | SOC 2 Type II | View DPA → |
| Fly.io | Replay worker compute — runs the agent loop and streams steps to the dashboard. | EU (Frankfurt) | EU residency | SOC 2 Type II | View DPA → |
| Stripe | Payments, subscriptions, and tax / billing record-keeping. | US (control plane) + EU (data) | DPF | PCI-DSS Level 1 · SOC 1 · SOC 2 Type II · ISO 27001 | View DPA → |
| Upstash | Redis for rate limiting, ephemeral state, and short-lived attribution storage. | EU (eu-west / Ireland) | EU residency | SOC 2 Type II | View DPA → |
| Sentry | Error tracking and performance monitoring (PII scrubbed in beforeSend). | EU (Frankfurt) | EU residency | SOC 2 Type II · ISO 27001 | View DPA → |
| Resend | Transactional email delivery — verification, billing receipts, replay-ready notifications. | United States (including EU-origin email) | SCCs | SOC 2 Type II | View DPA → |
| Slack (Salesforce) | Traitement par l’opérateur des messages d’assistance et de retour soumis ; livraison, à la demande du Client, des briefings et alertes du workspace lorsqu’elle est activée séparément. | United States | DPF | SOC 2 Type II · ISO 27001 · ISO 27701 | View DPA → |
Change notice
Customers receive at least 30 days' notice before any sub-processor is added or replaced, with the right to object on reasonable data-protection grounds. Subscribe via privacy@serge.ai to receive change notices by email.
Questions
Reach the privacy team at privacy@serge.ai. We respond within five business days.