Subprocessor List | Secure Stream

Overview

Secure Stream is a product and service offering owned and operated by Unveil Data LLC. This document identifies third-party subprocessors that Secure Stream engages, or may engage for optional customer-enabled features, to provide, support, secure, and operate the Services as described in the Secure Stream Terms of Service and Privacy Policy.

Core commitments

Secure Stream does not sell Customer Content or personal information, does not use Customer Content or personal information for advertising or targeted advertising, and does not use Customer Content to train artificial intelligence or machine learning models. Where Secure Stream uses third-party providers to process Customer Content, Secure Stream uses commercially reasonable efforts to contractually restrict those providers from using Customer Content for model training except as expressly disclosed or authorized by Customer.

Scope of processing

Not all subprocessors process all Customer Content. The specific subprocessors engaged depend on the Services, features, workflows, support channels, and optional processing selected or enabled by Customer. Optional AI-enabled providers are engaged only where the corresponding workflow is enabled, requested, or otherwise authorized.

Core Infrastructure and Platform Operations

Subprocessor	Purpose	Data Processed	Status / Scope	Location
Supabase	Database, file storage, project data storage, backend infrastructure, and authentication/session-related infrastructure where used.	Customer Content, uploaded files, recordings or exports stored in Supabase Storage, transcripts, captions, metadata, account data, access records, configuration data, operational logs.	Current core provider	United States / global infrastructure
Replit	Application hosting, development/runtime environment, backend services where used.	Customer Content where processed by hosted services, metadata, logs, operational data.	Current core provider	United States / global infrastructure
Vercel	Frontend hosting, application deployment, edge delivery, web application infrastructure.	IP addresses, request metadata, account/session metadata, limited Customer Content where rendered or routed through hosted application components.	Current core provider	Global infrastructure / U.S.-headquartered
Fly.io	Application hosting, backend services, worker runtime, transcript pipeline, live captions pipeline, regional compute.	Audio/transcript/caption data, Customer Content where processed by hosted services, metadata, logs, operational data.	Current core provider	Global infrastructure / U.S.-headquartered
Cloudflare	DNS/CDN/edge services where used, speed tests, network diagnostics, and break-glass storage through Cloudflare R2.	IP addresses, request metadata, network diagnostics, connectivity test data, logs, and Customer Content stored in Cloudflare R2 break-glass storage where enabled.	Current provider for specific workflows	Global infrastructure / U.S.-headquartered
Mux	Video streaming, live ingest, encoding, playback, recording/delivery support, playback analytics.	Video/audio stream data, playback metadata, viewer connection data, stream analytics, operational logs.	Current core provider	United States / global infrastructure
Ably	Real-time messaging, event delivery, caption/event routing, live state updates.	Caption events, room/session metadata, connection metadata, operational messages, limited Customer Content in real-time event payloads.	Current core provider	Global infrastructure / UK-headquartered

Authentication, Billing, Communications, and Support

Subprocessor	Purpose	Data Processed	Status / Scope	Location
Auth0 / Okta	Authentication, identity management, login, session management, SSO where enabled.	User identifiers, credentials/tokens, email addresses, login metadata, session data.	Current provider where enabled	United States / global infrastructure
Stripe	Payment processing, billing, invoices, subscription and transaction management.	Billing contact information, payment method tokens, transaction records, invoice data.	Current provider where used	United States / global infrastructure
Resend	Transactional email delivery, operational notifications, account/service emails.	Email addresses, message content, delivery metadata, account/project identifiers where included in email content.	Current provider	United States / global infrastructure
Slack	Internal stream support notifications, support triage, incident coordination, customer-submitted issue alerts.	Support messages, issue descriptions, project/session identifiers, contact information, operational metadata, limited Customer Content only if submitted in a support request or alert.	Current support provider	United States / global infrastructure

Business Operations and Administrative Providers

Subprocessor	Purpose	Data Processed	Status / Scope	Location
Google Workspace	Business email, internal documents, contracts, customer communications, and administrative operations.	Business contact information, emails, contracts, administrative records, and limited customer-related business information. Customer Content is not intentionally stored in Google Workspace as part of the core Services.	Business operations provider	United States / global infrastructure
Trello / Atlassian	Internal project management, task tracking, operational planning, and business administration.	Business contact information, project/task metadata, internal notes, and limited customer-related operational information. Customer Content is not intentionally stored in Trello as part of the core Services.	Business operations provider	United States / global infrastructure

Transcription, Diarization, and Optional AI-Enabled Processing

Subprocessor	Purpose	Data Processed	Status / Scope	Location
Deepgram	Speech recognition, live captions, transcription, diarization and keyword-related processing where enabled.	Audio, transcripts, captions, diarization data, keyword data, metadata.	Current provider	United States / global infrastructure
pyannoteAI / pyannote.audio API	Speaker diarization, speaker separation, speaker labeling, voice segment analysis.	Audio segments, speaker embeddings/metadata, diarization outputs, related processing metadata.	Current provider via hosted API	European Union / global infrastructure
OpenAI	Optional advanced analytics, summarization, structured text outputs, keyword extraction, assistant-style workflows where enabled or requested.	Text excerpts, transcript segments, prompts, metadata, structured outputs where Customer enables or requests the workflow.	Optional / feature-specific provider	United States / global infrastructure
Anthropic / Claude	Optional advanced analytics, summarization, structured text outputs, assistant-style workflows where enabled or requested.	Text excerpts, transcript segments, prompts, metadata, structured outputs where Customer enables or requests the workflow.	Optional / planned feature-specific provider	United States / global infrastructure

Important Notes

Optional providers. OpenAI and Anthropic / Claude are listed for transparency because Secure Stream may use one or both for optional advanced analytics, summarization, or customer-requested workflows. These providers are not engaged for Customer Content unless the applicable feature or service workflow is enabled, requested, or otherwise authorized.
Support channels. Slack is used for internal stream support notifications and issue triage. Customers should avoid submitting highly sensitive Customer Content through support channels unless necessary to resolve the issue. If Customer Content is included in a support request, Secure Stream treats it as confidential Customer Content.
Business operations providers. Google Workspace and Trello / Atlassian support administrative, communication, contract, and operational workflows. They are not intended to store or process live stream video, recordings, transcripts, captions, or other Customer Content as part of the core Services, except where Customer or Secure Stream provides such information for support, legal, contracting, or administrative purposes.
Data location. Unless otherwise agreed in a Data Processing Agreement, Order Form, or written agreement, Customer Content may be processed and stored in the United States. Certain subprocessors operate global infrastructure and may route traffic, metadata, or operational data through global edge or regional locations for performance, reliability, security, or service delivery.
Vendor commitments. Secure Stream uses commercially reasonable efforts to maintain appropriate contractual terms with subprocessors, including confidentiality obligations, security requirements, and restrictions on use of Customer Content. Subprocessor obligations may vary by provider, feature, and applicable agreement.
Changes to this list. Secure Stream may add, remove, or replace subprocessors as necessary to operate, secure, support, and improve the Services. Where required by an applicable Data Processing Agreement or written agreement, Secure Stream will provide notice of material subprocessor changes.

Contact

Questions about Secure Stream subprocessors may be directed to:

Unveil Data LLC

Operating as Secure Stream

support@securestream.io