Trust
Sub-processors
Serge relies on a small set of vetted third parties to deliver the product. This page lists every sub-processor that touches customer data, where it sits, the legal mechanism for any cross-border transfer, and a link to that provider's Data Processing Agreement. Customers under our DPA receive 30 days' notice before any sub-processor is added or replaced.
Last updated
| Provider | Purpose | Region | Transfer mechanism | Certifications | DPA |
|---|---|---|---|---|---|
| Vercel | Application hosting, edge runtime, CDN, and Blob storage for replay screenshots. | EU (Frankfurt) + US control plane | EU residency | SOC 2 Type II · ISO 27001 | View DPA → |
| Neon | Primary Postgres database — workspace data, scans, snippet events, replay metadata. | EU-Central (Frankfurt) | EU residency | SOC 2 Type II | View DPA → |
| Clerk | Authentication, session management, and identity provisioning. | United States | DPF | SOC 2 Type II | View DPA → |
| Anthropic | Claude API for campaign recommendations — receives the confirmed business facts (brand, category, offer, proof points), any audience note you type, and your writing voice and constraints to propose a first ad; also reads the public pages of a customer's website to draft those facts before they are confirmed; also runs the active replay (Investigate Mode) against the customer's site when that feature is enabled. No email address, account, or billing data is sent. | US (EU residency requires Enterprise / Bedrock) | SCCs | SOC 2 Type II | View DPA → |
| Browserbase | Managed headless Chrome instance for replay sessions. | EU (eu-central-1 Frankfurt) | EU residency | SOC 2 Type II | View DPA → |
| Fly.io | Replay worker compute — runs the agent loop and streams steps to the dashboard. | EU (Frankfurt) | EU residency | SOC 2 Type II | View DPA → |
| Stripe | Payments, subscriptions, and tax / billing record-keeping. | US (control plane) + EU (data) | DPF | PCI-DSS Level 1 · SOC 1 · SOC 2 Type II · ISO 27001 | View DPA → |
| Upstash | Redis for rate limiting, ephemeral state, and short-lived attribution storage. | EU (eu-west / Ireland) | EU residency | SOC 2 Type II | View DPA → |
| Sentry | Error tracking and performance monitoring (PII scrubbed in beforeSend). | EU (Frankfurt) | EU residency | SOC 2 Type II · ISO 27001 | View DPA → |
| Resend | Transactional email delivery — verification, billing receipts, replay-ready notifications. | United States (including EU-origin email) | SCCs | SOC 2 Type II | View DPA → |
| Slack (Salesforce) | Operator handling of submitted support and feedback messages; customer-directed workspace briefing and alert delivery when separately enabled. | United States | DPF | SOC 2 Type II · ISO 27001 · ISO 27701 | View DPA → |
Change notice
Customers receive at least 30 days' notice before any sub-processor is added or replaced, with the right to object on reasonable data-protection grounds. Subscribe via privacy@serge.ai to receive change notices by email.
Questions
Reach the privacy team at privacy@serge.ai. We respond within five business days.